Extracted

• • Target
    a54d4986e42a30f271bf1e70e9153b44.dll
  • Size 2.7MB
  • SHA256 1d58e9f81b10e3da48c2525020f25e6109f14026e1234041bf7131c5b8c0c8bd
  • MD5 a54d4986e42a30f271bf1e70e9153b44
  • SHA1 a7f8b572c7afd435690200115adf3b047486d3a6
  • SHA512 f5895ca7f359b18d9cee671dfc904cc1417d01b2abf0e67195397dabb0d463ed64b9a64edb299f000a54aad3e0139879859363bc3086a62101d09a7b58f51532
  • SSDEEP 49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYch2ek:P1Kqvv07noI7lOOYcz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xmrigevasionminerspywarestealerupx

  • Modifies security service

    evasion

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Stops running service(s)

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2