General
- Target 313f90db50cc3d4164b90d648b83cd75.exe
- Size 671KB
- Sample201203-c1g84z59w2
- SHA256 69057a29d94d0ae3e51c435df396178b093d057db5addcdb273dcd5aedc6e1ef
Score
10/10
Malware Config
Targets
-
- Target 313f90db50cc3d4164b90d648b83cd75.exe
- Size 671KB
- SHA256 69057a29d94d0ae3e51c435df396178b093d057db5addcdb273dcd5aedc6e1ef
Score10/10CryptBot
A C++ stealer distributed widely in bundle with other software.
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
Identifies VirtualBox via ACPI registry values (likely anti-VM)
XMRig Miner Payload
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Deletes itself
Drops startup file
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
autoit_exe
AutoIT scripts compiled to PE executables.