General
-
Target
e0a64ea350aed7cc5e867677944b03e3.bin
-
Size
1.4MB
-
Sample
230331-clwc1agc79
-
MD5
9659412afb49eefb2d3fdf69118c56ea
-
SHA1
e226f98b4317173b316c615ccb1abb30e39cbd40
-
SHA256
3c2059858a634122464ac75a2ef3c0e09d8d4c8b7b1961a419b64f1a356d2c7a
-
SHA512
b93a1c4782fae1b569bc36696bee3d0a9c4c81802090901aa44ca751b7b01558b62a8c1d66fd70445ea648b0ddbd55a60a4107445f46c23b5034381aefcbb9e0
-
SSDEEP
24576:JPdWHGKoCOiOhN0SKgCcMcfWrVRY1Kof/hmcxAkfQnaVy8iRdtlJ5yDE9SY:JZCECSK9kQP2/1AkkanillvmEz
Static task
static1
Behavioral task
behavioral1
Sample
1d3329d2fc6d022e283a519b328991098f0d9c7bf01fa2eeaa941ec3bc44b2ef.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1d3329d2fc6d022e283a519b328991098f0d9c7bf01fa2eeaa941ec3bc44b2ef.exe
Resource
win10v2004-20230221-en
Malware Config
Targets
-
-
Target
1d3329d2fc6d022e283a519b328991098f0d9c7bf01fa2eeaa941ec3bc44b2ef.exe
-
Size
2.6MB
-
MD5
e0a64ea350aed7cc5e867677944b03e3
-
SHA1
e0f62ed674ba6c79b215d82babc733f05623ab24
-
SHA256
1d3329d2fc6d022e283a519b328991098f0d9c7bf01fa2eeaa941ec3bc44b2ef
-
SHA512
921c94526b0b30fa32d46d11474133cbbb69e2c816b26e54a7002649ad100787b83e33d7369119c4feb1462d8a8db58889355a030a2ba4fe0f1ca904472e1ccb
-
SSDEEP
24576:q5vWSTfOvF//1SbrNnT/feTtJ2h8IYb2ny/v/LtGZsYjot0VHeaw5qGabocdcyoQ:q5vWSw0bUTWHMqT3dYMfY/HDr/G
Score10/10-
XMRig Miner payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-