Overview

overview

10

Static

static

cd19340138...5f.exe

windows7_x64

10

cd19340138...5f.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd19340138f9eab48d20b3bf0a9dc6b4a6908d14cd48511ccefd6dba9e84705f

  • Size

    1.3MB

  • Sample

    210429-xymx5kn4qa

  • MD5

    0e64acab6fb3d50aaebc17e6dfb2d289

  • SHA1

    c5c672a4a8ebae04cf7471c56136dce58ccd88f0

  • SHA256

    cd19340138f9eab48d20b3bf0a9dc6b4a6908d14cd48511ccefd6dba9e84705f

  • SHA512

    e797d31d7355d1f222a444fa934599582ffd9593185668382b9ad05ade1086d152f342305fb1b734a4cc0f691b2b4ba70fd8f183f77aa3f6f775a470fb4e7013

Score
10/10
xmrigevasionminerransomwarespywarestealer

Malware Config

Targets

    • Target

      cd19340138f9eab48d20b3bf0a9dc6b4a6908d14cd48511ccefd6dba9e84705f

    • Size

      1.3MB

    • MD5

      0e64acab6fb3d50aaebc17e6dfb2d289

    • SHA1

      c5c672a4a8ebae04cf7471c56136dce58ccd88f0

    • SHA256

      cd19340138f9eab48d20b3bf0a9dc6b4a6908d14cd48511ccefd6dba9e84705f

    • SHA512

      e797d31d7355d1f222a444fa934599582ffd9593185668382b9ad05ade1086d152f342305fb1b734a4cc0f691b2b4ba70fd8f183f77aa3f6f775a470fb4e7013

    Score
    10/10
    xmrigevasionminerransomwarespywarestealer

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Drops file in Drivers directory

    • Modifies Windows Firewall

      evasion

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks