Back to Malware Drops
8923bb4758ee4f8bb122d61391f373bf2bdcc705142beb758bfe22ecd7740e26
MD5b84f000da52dec0060bf5c8eaea188d3
SSDEEP384:G6CEHeJbHG60H+I0/MtJyjpKH6DUqBuRyRG+o1SS48WG0l1XDs/t9:G6C4mHG60H9/EpKH6DRuRyRG+oQ1nGyy
File Typetext/x-script
Size13.5 KB
Sources161
Downloads0
First SeenAug 26, 2021
Last SeenNov 28, 2021
Download sample (.zip, password: infected)
Live malware — handle only in an isolated analysis environment.
Originating Attacks
Honeypot sessions that dropped this sample. Drop URLs are defanged; commands are shown verbatim and are not links.
- Dropped in this session (no command captured).Aug 26, 2021, 12:55:26 AMView attack session
- Dropped in this session (no command captured).Aug 26, 2021, 12:55:26 AMView attack session
- Dropped in this session (no command captured).Aug 26, 2021, 12:55:26 AMView attack session
- Dropped in this session (no command captured).Aug 26, 2021, 12:55:26 AMView attack session
- Dropped in this session (no command captured).Aug 26, 2021, 12:55:26 AMView attack session
Indicators of Compromise
Values are defanged (e.g. hxxp://, [.]) — not live links.
domain (3)
- c3pool[.]com
- download[.]c3pool[.]com
- github[.]com
email (1)
- support@c3pool[.]com
url (4)
- hxxp://download[.]c3pool[.]com/xmrig_setup/raw/master/xmrig[.]tar[.]gz
- hxxps://c3pool[.]com
- hxxps://github[.]com
- hxxps://github[.]com/xmrig/xmrig/releases/latest