General

  • Target

    f81d2b083548afd9b722626a4d2d94ff9f180b9fbb57e66c42036a4317bca1cb

  • Size

    118KB

  • Sample

    210505-xfp8aw3ghs

  • MD5

    d2d0810fa6f942c316339a48c865d41b

  • SHA1

    d5adefd42699b367307639e1a298f07a56513e6c

  • SHA256

    f81d2b083548afd9b722626a4d2d94ff9f180b9fbb57e66c42036a4317bca1cb

  • SHA512

    b679711faf592c9aac2c10dd438974e2a52300c38ff4e647ce26de62e9c0f7c8fb70c6ebfab4dd11fe776dfd86159a41c61bb895d9877f1eed6168eed509c613

Score
10/10

Malware Config

Targets

    • Target

      f81d2b083548afd9b722626a4d2d94ff9f180b9fbb57e66c42036a4317bca1cb

    • Size

      118KB

    • MD5

      d2d0810fa6f942c316339a48c865d41b

    • SHA1

      d5adefd42699b367307639e1a298f07a56513e6c

    • SHA256

      f81d2b083548afd9b722626a4d2d94ff9f180b9fbb57e66c42036a4317bca1cb

    • SHA512

      b679711faf592c9aac2c10dd438974e2a52300c38ff4e647ce26de62e9c0f7c8fb70c6ebfab4dd11fe776dfd86159a41c61bb895d9877f1eed6168eed509c613

    Score
    10/10
    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks