General
- Target 2026-11-12_438bc2bca0cda120b20e55a91f5488e4_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc
- Size 18.3MB
- Sample261113-ezjbpsfv8s
- SHA256 69ec5739276987c0472b888783613c61bacf2d1d7c8fd818e3f7d5db484c8074
Score
10/10
Malware Config
Targets
-
- Target 2026-11-12_438bc2bca0cda120b20e55a91f5488e4_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc
- Size 18.3MB
- SHA256 69ec5739276987c0472b888783613c61bacf2d1d7c8fd818e3f7d5db484c8074
Score10/10Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
XMRig Miner payload
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Cryptocurrency Miner
Makes network request to known mining pool URL.
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
Executes dropped EXE
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.