xmrig | 61434bf05605522eb3e618f0b6e0637e62042b76e94e0cdee2daa61a8f36267d

General

Target
2026-11-11_53e2bb3ea1854acc6daef1d7d9dea04a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample261113-pe5pbabt5v
SHA256 61434bf05605522eb3e618f0b6e0637e62042b76e94e0cdee2daa61a8f36267d
MD5 53e2bb3ea1854acc6daef1d7d9dea04a
SHA1 95a5d52daa596f2b903433471f61b5be9ac568dd
SHA512 3ddd5e7eca4414ca7a96cd395f11a3c870d923a172462df3d04257b619b3adcf5bbdf08305cb8b722e14d7c1070f6f4ac8a700c2338ebd8042ae145b76961c69
SSDEEP 6144:bsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRvZ0RzS:7H7F6cf6T7Ow5JR
TLSH
T129947D16EA65307DE1A7D238CD678902E6B57C4E07A19ACF03D449A22F276E0DF3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-11_53e2bb3ea1854acc6daef1d7d9dea04a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 61434bf05605522eb3e618f0b6e0637e62042b76e94e0cdee2daa61a8f36267d
- MD5 53e2bb3ea1854acc6daef1d7d9dea04a
- SHA1 95a5d52daa596f2b903433471f61b5be9ac568dd
- SHA512 3ddd5e7eca4414ca7a96cd395f11a3c870d923a172462df3d04257b619b3adcf5bbdf08305cb8b722e14d7c1070f6f4ac8a700c2338ebd8042ae145b76961c69
- SSDEEP 6144:bsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRvZ0RzS:7H7F6cf6T7Ow5JR
- TLSH
  T129947D16EA65307DE1A7D238CD678902E6B57C4E07A19ACF03D449A22F276E0DF3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit xmrig miner persistence privilege_escalation upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Custom signature
  
  UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2