Overview

overview

10

Static

static

10

inst.ps1

windows10-2004-x64

8

inst.ps1

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    inst.ps1
  • Size 19KB
  • Sample261113-lwr8rss19p
  • SHA256 956abc4928ffc89762df44df4bb253ab2e832956710ac5918c581c18493bd464
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionminerpersistence

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://github.com/doktor83/SRBMiner-Multi/releases/download/3.8.7/SRBMiner-Multi-3-8-7-win64.zip

Targets

    • Target
      inst.ps1
    • Size 19KB
    • SHA256 956abc4928ffc89762df44df4bb253ab2e832956710ac5918c581c18493bd464
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    executionpersistencedefense_evasionminer

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      defense_evasion

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Cryptocurrency Miner

      Makes network request to known mining pool URL.

      miner
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks