Behavioral task
behavioral1
Sample
d6d76fa5c46ce88e8def28ab03889c00078284de39865f0b00b6b5dce603ce16.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
d6d76fa5c46ce88e8def28ab03889c00078284de39865f0b00b6b5dce603ce16.exe
Resource
win10v2004-20230221-en
General
-
Target
76e589cd500d372bbae39b2f973c065c.bin
-
Size
5.4MB
-
MD5
efaebf3582ca254487328a9a83f44a91
-
SHA1
6a1ee6d9787caabe7b79aa3c57b1f9c7dc17cc46
-
SHA256
f22b548b5ba121b8b321156dd1ca838f7f32c9f0d190a07c358e57010a644d7e
-
SHA512
fd54c1ccb907b751ade7cdfaf749fc4f31ed088977ba4c251c090e342e9bf4d6415e6ae8a5a094328cdeb6b595de2649cd9793523f4e4b1b3f16cb23a118d062
-
SSDEEP
98304:oDBu7d2z32JVATzi37VI8kDWGx172JdJutj3LHGU6+fLWrjH:+u7ZJVAT+3Z7kHx17aCtj7Hz7fW
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
resource yara_rule static1/unpack001/d6d76fa5c46ce88e8def28ab03889c00078284de39865f0b00b6b5dce603ce16.exe xmrig static1/unpack001/d6d76fa5c46ce88e8def28ab03889c00078284de39865f0b00b6b5dce603ce16.exe family_xmrig -
Xmrig family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d6d76fa5c46ce88e8def28ab03889c00078284de39865f0b00b6b5dce603ce16.exe
Files
-
76e589cd500d372bbae39b2f973c065c.bin.zip
Password: infected
-
d6d76fa5c46ce88e8def28ab03889c00078284de39865f0b00b6b5dce603ce16.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ