{"id":"a0cb61f3856038578d308f02baaca00c","title":"XMRig — XMRig · 挖矿木马 · ELF64","md5":"a0cb61f3856038578d308f02baaca00c","sha256":"504cb139bbc3d10dc2febee86d854db2b59c5aa55c6a5c49619dea4d37e1fc11","family":"XMRig","apt":null,"verdict":null,"sample_type":"挖矿木马","lang":"Rust","file_format":"ELF64","compiler":"Rust","published_at":"2026-08-10T16:00:00.000Z","summary":"该样本为 XMRig 门罗币（Monero/XMR）挖矿程序的 Rust 编译版本，未授权部署用于挖矿牟利。证据：① 内置完整 XMRig 配置（xmrig.com/docs/algorithms、api.xmrig.com、nicehash 支持、donate 捐赠）；② 配置多个矿池作为回退：wixerzhongboost.eu:5555（自定义池）、pool.supportxmr.com:5555、mine.c3pool.com:13333 及大量 IP 直连矿池（141.94.96.71:3333/443/7777、54.38.33.16:3333/5555/7777、121.32.254.175:3333、114.114.114.114:3333 等）；③ 内置攻击者 Monero 钱包地址（user 字段 46d1re6b... 与 47qQHFXf...）；④ 矿池密码 \"pass\":\"C4\"；⑤ 链接 OpenSSL/wolfSSL。CAPA 检出 cryptocurrency 字符串、写并执行文件、创建进程等能力。","url":"https://zseceye.com/report/a0cb61f3856038578d308f02baaca00c","json_url":"https://zseceye.com/report/a0cb61f3856038578d308f02baaca00c.json","html_url":"https://zseceye.com/report/a0cb61f3856038578d308f02baaca00c","hash_urls":{"md5":"https://zseceye.com/hash/a0cb61f3856038578d308f02baaca00c","sha256":"https://zseceye.com/hash/504cb139bbc3d10dc2febee86d854db2b59c5aa55c6a5c49619dea4d37e1fc11"},"search_urls":{"md5":"https://zseceye.com/?q=a0cb61f3856038578d308f02baaca00c","sha256":"https://zseceye.com/?q=504cb139bbc3d10dc2febee86d854db2b59c5aa55c6a5c49619dea4d37e1fc11"},"sample_download_url":"https://zseceye.com/report/a0cb61f3856038578d308f02baaca00c/sample","sample_filename":"504cb139.zip","iocs":[],"ips":[]}