xmrig | c841080dcf8a3d1ce7d3f4777863d9d693871d68540ab3c207a36e0200714660

Sharing

Copy URL Twitter E-mail

General

Target
AVAlLABLE_SETUP_(KEY.2123).zip
Size 590KB
Sample261102-dd3msass4p
SHA256 c841080dcf8a3d1ce7d3f4777863d9d693871d68540ab3c207a36e0200714660
MD5 37efdb5aaabdae090d429e69e49548c9
SHA1 26dbb1a0eb14c8e7d915d28e479ee86700b1e602
SHA512 7c8ca053254aa26ab7f52914daab145628a8fc5b0ef4f49614d9aceee8249a0dbd7afeb583e558f6ef9b5b667d7346a6316ca21602d4f1b14760df7fa12cee7f
SSDEEP 12288:7czlsjw+k84hU/gxNJA4hoMaHV5DN8OTEHpttCtsvldUn6Y9X:762BOLVhcpl0BKsddd4X
TLSH
T1F7D42301219DF035C0A6523A34C1ECC788D96BAB71BF73F18E56399D48F72487A66772
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  AVAlLABLE_SETUP_(KEY.2123).zip
- Size 590KB
- SHA256 c841080dcf8a3d1ce7d3f4777863d9d693871d68540ab3c207a36e0200714660
- MD5 37efdb5aaabdae090d429e69e49548c9
- SHA1 26dbb1a0eb14c8e7d915d28e479ee86700b1e602
- SHA512 7c8ca053254aa26ab7f52914daab145628a8fc5b0ef4f49614d9aceee8249a0dbd7afeb583e558f6ef9b5b667d7346a6316ca21602d4f1b14760df7fa12cee7f
- SSDEEP 12288:7czlsjw+k84hU/gxNJA4hoMaHV5DN8OTEHpttCtsvldUn6Y9X:762BOLVhcpl0BKsddd4X
- TLSH
  T1F7D42301219DF035C0A6523A34C1ECC788D96BAB71BF73F18E56399D48F72487A66772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  PASS_KEY.docx
- Size 22KB
- SHA256 76422a64196dc6bab36f04679c7119b88c743058f8439b1ac715e2e2c13a98e7
- MD5 4187f92d726157f3774db438c4784f0c
- SHA1 e6ebcb1e3a97a3836ee65e27b2f4124ba5f42cb2
- SHA512 a02690f85c77b5ddd66a3e5643795d458faa39e0eac99b50604cb2871e05bc335d9f62b82aec6a333f4c4c55e97a56afea9aa9b46e25cba35c90218e37185b62
- SSDEEP 384:Smp/eNUnEpmkZ3w1HdJ7iFOmg8cte2N0KfWmCqaylhoB/Cofx4e:xek2329JGFqzenKfWhqmB/vl
- TLSH
  T1CCA2C0A48515B819D6A3407D903102FDF6C61042A612B5EFF421DAE9F38A577073EBB8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  𝙎𝙀𝙏𝙐𝙋_𝙡𝙉𝙎𝙏𝘼𝙇𝙇𝙀𝙍.zip
- Size 570KB
- SHA256 287ad79d556225fa27a7a140751cf5ae57963c541525c7873e6c30c0478538a8
- MD5 615058571a5d1cd7530ccafb34a879a7
- SHA1 2d9fed560cce7366338761fba1d1072f7338dbaa
- SHA512 1fa900c53163dcb70def10ae6aed0fc65b00ded926510bee58ffdd14c07c5963edcb6cfe27a296dd2eae4ee60855255938c7472112c328ba2c5c8f9a110e1818
- SSDEEP 12288:ezlsjw+k84hU/gxNJA4hoMaHV5DN8OTEHpttCtsvldUn6Y9L:o2BOLVhcpl0BKsddd4L
- TLSH
  T1EBC42302118DF03680D5523A34C2ECC788E96BEB71BF77B1CF56299E08B7149BA66771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  SETUP.zip
- Size 571KB
- SHA256 781d89902db737e9c278b798c400fc23f987dbd5eb3c27034b4d457c2061bce6
- MD5 987240abab2ef2a6cff2a3bd71e5a720
- SHA1 0df5d84fe82c54c3a5e26ba96874a08e9926627c
- SHA512 650fccd968f65f6eab75c97dd5936d8e0120d0378bca3f49353cb57c2c9bb44138c23f107ccc49465a0ed77a598b3c33e50a16930da59658bbacb7ac34e495b3
- SSDEEP 12288:0JCSDQZCeadnh3LhxBnTWst3rrX5ZcLkWqu4f0TyMxBR5D7wY9AM2i3cGcfP:0JIZK5h3/BnTWst3r1ZctTc0LxBR5DE7
- TLSH
  T15BC4234BBBF4984716B77FB6EC2BB520EA16C8FD544154B29ADF54A61CC2122ED00CEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Setup.exe
- Size 1.1MB
- SHA256 f768ff1b70aad0810715bec8935082f8845988722be2ffa991d94a5f880bb20f
- MD5 2fff0b546d537287fe9abb0074a9222c
- SHA1 3a857b783a04ce483675da0613a28950d573a676
- SHA512 02116ac2ff137acfe3c1e1752426dad2f12fa99e43946a5342b8c3e56eeeab895e92c2779c735a23c1d9fcc621641f9852303d8d0922fa2989cd8fdba486fa08
- SSDEEP 12288:jhnvypF6zKGKEsPWdal/WooWFhHraUsARHfDxGTkjaZpk+IBkhhMhSWaZeF+GkY:wpFY4Wdl0Jeq5fQK+Skh+hFF+GkY
- TLSH
  T1FD4547F0F3810DFDFD3886378657A928911239DE1ED13AAA475C134F0A26E91BAF560D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery execution xmrig miner persistence privilege_escalation spyware
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Suspicious use of NtCreateUserProcessOtherParentProcess
  defense_evasion privilege_escalation
- XMRig Miner payload
  miner
- Downloads MZ/PE file
- Executes dropped EXE
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of SetThreadContext
behavioral10 behavioral9