xmrig | 3aaf9613f8fdc61141527e8527296ed61a61405d602cc6c3426f239f4eec5c60 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3aaf9613f8fdc61141527e8527296ed61a61405d602cc6c3426f239f4eec5c60
Size

2.5MB
MD5

e7708e0e0363d62f9b04ea6d64754a20
SHA1

7b3f8668656a06e669f77de751bd778257bbc620
SHA256

3aaf9613f8fdc61141527e8527296ed61a61405d602cc6c3426f239f4eec5c60
SHA512

2cd9c9719cd7f82df01516e49a6a00e461ca11ba96108b24058f9fb62bde9a00dd438d06ab04d71af3b7ead6c00f7f34aeed4d44d08a1cecc84ca23e5fe0c205
SSDEEP

49152:N0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzHUrk7SSfwd:N0GnJMOWPClFdx6e0EALKWVTffZiPAcE

Score

10^/10

miner upx xmrig

Malware Config

Signatures

XMRig Miner payload 1 IoCs

resource	yara_rule
sample	xmrig

Xmrig family
xmrig

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

3aaf9613f8fdc61141527e8527296ed61a61405d602cc6c3426f239f4eec5c60
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: 1.3MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 525KB - Virtual size: 528KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE