Overview

overview

10

Static

static

newversion12.exe

windows7-x64

3

newversion12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    newversion12

  • Size

    172KB

  • Sample

    221123-malpjagg9x

  • MD5

    e26bba0dacf042a4cce6764f1410cfba

  • SHA1

    0120022b5294ce72f360bcf78125da1b81c2a5bc

  • SHA256

    0732020623f16c48d7537161612cfcd101fb0783fac498b9e05a1b38aabdbda5

  • SHA512

    c9237f43d05cbbd80c80db0f0ac328c65c6073579461d57a1d6b43367823bdaaf62f48836a2e7c77a81ca69ce2e33f62395ea6065c26943275872632f963792a

  • SSDEEP

    1536:2AEZc9URWzKr7PhuuUpV7+5JTiy95iuUCQahsf5mZIWiwwr7QXsouW2ASDDA6rRP:21ZpWaxa7Dy95kS2Q/xnevXtTGSaOv

Score
10/10
xmrigminerupx

Malware Config

Targets

    • Target

      newversion12

    • Size

      172KB

    • MD5

      e26bba0dacf042a4cce6764f1410cfba

    • SHA1

      0120022b5294ce72f360bcf78125da1b81c2a5bc

    • SHA256

      0732020623f16c48d7537161612cfcd101fb0783fac498b9e05a1b38aabdbda5

    • SHA512

      c9237f43d05cbbd80c80db0f0ac328c65c6073579461d57a1d6b43367823bdaaf62f48836a2e7c77a81ca69ce2e33f62395ea6065c26943275872632f963792a

    • SSDEEP

      1536:2AEZc9URWzKr7PhuuUpV7+5JTiy95iuUCQahsf5mZIWiwwr7QXsouW2ASDDA6rRP:21ZpWaxa7Dy95kS2Q/xnevXtTGSaOv

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks