Overview

overview

10

Static

static

1

win.bat

windows10-1703-x64

10

win_1.bat

windows10-1703-x64

10

win_10.bat

windows10-1703-x64

10

win_11.bat

windows10-1703-x64

10

win_2.bat

windows10-1703-x64

10

win_3.bat

windows10-1703-x64

10

win_4.bat

windows10-1703-x64

10

win_5.bat

windows10-1703-x64

10

win_6.bat

windows10-1703-x64

10

win_7.bat

windows10-1703-x64

10

win_8.bat

windows10-1703-x64

10

win_9.bat

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    kopie.zip

  • Size

    6KB

  • Sample

    230630-r6adlade54

  • MD5

    f2a72b25cf932adaddbafa0544502734

  • SHA1

    c79ee340ac659120d559a48c74c032cd8fcc9112

  • SHA256

    c2fe05164b92d20e8976f4994bdea7a7e9bd4cb9f85d9dcecef9c5876a5bfd70

  • SHA512

    16de5c096079fccef5da777a7de756b1fbed045955005d9368a02663e663f6945690186450723c1da034ae177d9828533d64e1ba47173dbd93b4c810d01debf9

  • SSDEEP

    96:1EjC6NcEjC6NxEjC6NWEjC6NpEjC6NuEjC6NDEjC6NAEjC6NtEjC6NCEjC6NnEj2:ejXjujdjejNjUjzjKjpjAjfjS

Score
10/10
upx

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/rplant8/cpuminer-opt-rplant/releases/latest/download/cpuminer-opt-win.zip

Targets

    • Target

      win.bat

    • Size

      706B

    • MD5

      ddc05c409f627a4382bff4c3a49423df

    • SHA1

      0f77ae481593bc1b0669dae7a044d0b96f39413f

    • SHA256

      6daf93d284bd5d39f613d6d3f96c083d1b99baa10e7acbf65f74ab84fe551887

    • SHA512

      0bdfacc137a0f40cfffa34d3549961fe20dc35905e14a9b5c207cab380594dff09dfe641a534fb0d3211bcce3b727801df8c7c635fbc9c0cd26d6e7914818cc3

    Score
    10/10
    upx

    • Blocklisted process makes network request

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

    • Target

      win_1.bat

    • Size

      706B

    • MD5

      ddc05c409f627a4382bff4c3a49423df

    • SHA1

      0f77ae481593bc1b0669dae7a044d0b96f39413f

    • SHA256

      6daf93d284bd5d39f613d6d3f96c083d1b99baa10e7acbf65f74ab84fe551887

    • SHA512

      0bdfacc137a0f40cfffa34d3549961fe20dc35905e14a9b5c207cab380594dff09dfe641a534fb0d3211bcce3b727801df8c7c635fbc9c0cd26d6e7914818cc3

    Score
    10/10
    upx

    • Blocklisted process makes network request

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral2

    • Target

      win_10.bat

    • Size

      706B

    • MD5

      ddc05c409f627a4382bff4c3a49423df

    • SHA1

      0f77ae481593bc1b0669dae7a044d0b96f39413f

    • SHA256

      6daf93d284bd5d39f613d6d3f96c083d1b99baa10e7acbf65f74ab84fe551887

    • SHA512

      0bdfacc137a0f40cfffa34d3549961fe20dc35905e14a9b5c207cab380594dff09dfe641a534fb0d3211bcce3b727801df8c7c635fbc9c0cd26d6e7914818cc3

    Score
    10/10
    upx

    • Blocklisted process makes network request

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3

    • Target

      win_11.bat

    • Size

      706B

    • MD5

      ddc05c409f627a4382bff4c3a49423df

    • SHA1

      0f77ae481593bc1b0669dae7a044d0b96f39413f

    • SHA256

      6daf93d284bd5d39f613d6d3f96c083d1b99baa10e7acbf65f74ab84fe551887

    • SHA512

      0bdfacc137a0f40cfffa34d3549961fe20dc35905e14a9b5c207cab380594dff09dfe641a534fb0d3211bcce3b727801df8c7c635fbc9c0cd26d6e7914818cc3

    Score
    10/10
    upx

    • Blocklisted process makes network request

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral4

    • Target

      win_2.bat

    • Size

      706B

    • MD5

      ddc05c409f627a4382bff4c3a49423df

    • SHA1

      0f77ae481593bc1b0669dae7a044d0b96f39413f

    • SHA256

      6daf93d284bd5d39f613d6d3f96c083d1b99baa10e7acbf65f74ab84fe551887

    • SHA512

      0bdfacc137a0f40cfffa34d3549961fe20dc35905e14a9b5c207cab380594dff09dfe641a534fb0d3211bcce3b727801df8c7c635fbc9c0cd26d6e7914818cc3

    Score
    10/10
    upx

    • Blocklisted process makes network request

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral5

    • Target

      win_3.bat

    • Size

      706B

    • MD5

      ddc05c409f627a4382bff4c3a49423df

    • SHA1

      0f77ae481593bc1b0669dae7a044d0b96f39413f

    • SHA256

      6daf93d284bd5d39f613d6d3f96c083d1b99baa10e7acbf65f74ab84fe551887

    • SHA512

      0bdfacc137a0f40cfffa34d3549961fe20dc35905e14a9b5c207cab380594dff09dfe641a534fb0d3211bcce3b727801df8c7c635fbc9c0cd26d6e7914818cc3

    Score
    10/10
    upx

    • Blocklisted process makes network request

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral6

    • Target

      win_4.bat

    • Size

      706B

    • MD5

      ddc05c409f627a4382bff4c3a49423df

    • SHA1

      0f77ae481593bc1b0669dae7a044d0b96f39413f

    • SHA256

      6daf93d284bd5d39f613d6d3f96c083d1b99baa10e7acbf65f74ab84fe551887

    • SHA512

      0bdfacc137a0f40cfffa34d3549961fe20dc35905e14a9b5c207cab380594dff09dfe641a534fb0d3211bcce3b727801df8c7c635fbc9c0cd26d6e7914818cc3

    Score
    10/10
    upx

    • Blocklisted process makes network request

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral7

    • Target

      win_5.bat

    • Size

      706B

    • MD5

      ddc05c409f627a4382bff4c3a49423df

    • SHA1

      0f77ae481593bc1b0669dae7a044d0b96f39413f

    • SHA256

      6daf93d284bd5d39f613d6d3f96c083d1b99baa10e7acbf65f74ab84fe551887

    • SHA512

      0bdfacc137a0f40cfffa34d3549961fe20dc35905e14a9b5c207cab380594dff09dfe641a534fb0d3211bcce3b727801df8c7c635fbc9c0cd26d6e7914818cc3

    Score
    10/10
    upx

    • Blocklisted process makes network request

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral8

    • Target

      win_6.bat

    • Size

      706B

    • MD5

      ddc05c409f627a4382bff4c3a49423df

    • SHA1

      0f77ae481593bc1b0669dae7a044d0b96f39413f

    • SHA256

      6daf93d284bd5d39f613d6d3f96c083d1b99baa10e7acbf65f74ab84fe551887

    • SHA512

      0bdfacc137a0f40cfffa34d3549961fe20dc35905e14a9b5c207cab380594dff09dfe641a534fb0d3211bcce3b727801df8c7c635fbc9c0cd26d6e7914818cc3

    Score
    10/10

    • Blocklisted process makes network request

    behavioral9

    • Target

      win_7.bat

    • Size

      706B

    • MD5

      ddc05c409f627a4382bff4c3a49423df

    • SHA1

      0f77ae481593bc1b0669dae7a044d0b96f39413f

    • SHA256

      6daf93d284bd5d39f613d6d3f96c083d1b99baa10e7acbf65f74ab84fe551887

    • SHA512

      0bdfacc137a0f40cfffa34d3549961fe20dc35905e14a9b5c207cab380594dff09dfe641a534fb0d3211bcce3b727801df8c7c635fbc9c0cd26d6e7914818cc3

    Score
    10/10
    upx

    • Blocklisted process makes network request

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral10

    • Target

      win_8.bat

    • Size

      706B

    • MD5

      ddc05c409f627a4382bff4c3a49423df

    • SHA1

      0f77ae481593bc1b0669dae7a044d0b96f39413f

    • SHA256

      6daf93d284bd5d39f613d6d3f96c083d1b99baa10e7acbf65f74ab84fe551887

    • SHA512

      0bdfacc137a0f40cfffa34d3549961fe20dc35905e14a9b5c207cab380594dff09dfe641a534fb0d3211bcce3b727801df8c7c635fbc9c0cd26d6e7914818cc3

    Score
    10/10
    upx

    • Blocklisted process makes network request

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral11

    • Target

      win_9.bat

    • Size

      706B

    • MD5

      ddc05c409f627a4382bff4c3a49423df

    • SHA1

      0f77ae481593bc1b0669dae7a044d0b96f39413f

    • SHA256

      6daf93d284bd5d39f613d6d3f96c083d1b99baa10e7acbf65f74ab84fe551887

    • SHA512

      0bdfacc137a0f40cfffa34d3549961fe20dc35905e14a9b5c207cab380594dff09dfe641a534fb0d3211bcce3b727801df8c7c635fbc9c0cd26d6e7914818cc3

    Score
    10/10
    upx

    • Blocklisted process makes network request

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral12

MITRE ATT&CK Matrix

Tasks