xmrig

General

Target

5542c735df933488bc16709000e854d7.exe
Size

4.8MB
Sample

210225-2ny62l2mra
MD5

5542c735df933488bc16709000e854d7
SHA1

c592e67415071e782e7ac85038107e78b46e35bb
SHA256

4535d19558108c23e59535eb6d5b90f1c707e365e87bc3340fe5e17973c70b0c
SHA512

2fd1cc5cdff3bda28dad68e692c61e335b8e854876180fd4734b912f45ece65bbced36be4bb06d0976ddebc3c0838851a46d2938e7a3cd99ce0586416e321628

Score

10^/10

Malware Config

Targets

- Target
  
  5542c735df933488bc16709000e854d7.exe
- Size
  
  4.8MB
- MD5
  
  5542c735df933488bc16709000e854d7
- SHA1
  
  c592e67415071e782e7ac85038107e78b46e35bb
- SHA256
  
  4535d19558108c23e59535eb6d5b90f1c707e365e87bc3340fe5e17973c70b0c
- SHA512
  
  2fd1cc5cdff3bda28dad68e692c61e335b8e854876180fd4734b912f45ece65bbced36be4bb06d0976ddebc3c0838851a46d2938e7a3cd99ce0586416e321628
Score

10^/10

xmrig bootkit discovery evasion miner persistence spyware upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Creates new service(s)
  persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2