xmrig | df0e1a08cfd1f4e3275b89f5e45d69f380bf9e233a57412621cf8cd06a80b937 | Triage

Sharing

General

Target

df0e1a08cfd1f4e3275b89f5e45d69f380bf9e233a57412621cf8cd06a80b937
Size

2.4MB
MD5

48b2a607811423ada70154684fc65799
SHA1

092d4f3fe07facadc027c13da499bf8f533b2df1
SHA256

df0e1a08cfd1f4e3275b89f5e45d69f380bf9e233a57412621cf8cd06a80b937
SHA512

067eff3ef4b9ba1b2b2dc4ecdfdf3e3a2f98b104f0b5f4c35fa624a77a31a889b0b6b192763e47ee0f496c0db09d0a5872bba1a2d3e317e759fa769363587627
SSDEEP

49152:N0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8Dz05aIwC+AcX:N0GnJMOWPClFdx6e0EALKWVTffZiPAcL

Score

10^/10

miner upx xmrig privateloader

Malware Config

Signatures

Privateloader family
privateloader

XMRig Miner payload 1 IoCs

resource	yara_rule
sample	xmrig

Xmrig family
xmrig

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Files

df0e1a08cfd1f4e3275b89f5e45d69f380bf9e233a57412621cf8cd06a80b937
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: 1.3MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 525KB - Virtual size: 528KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE