xmrig | NEAS[.]655dcd1018074b16b8e73ceb995b84b0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.655dcd1018074b16b8e73ceb995b84b0.exe
Size

1.3MB
MD5

655dcd1018074b16b8e73ceb995b84b0
SHA1

3d2415a33390d6b155786d194dad07219c636226
SHA256

94e01e6cc8653f019fb2c4d2801a3a6c2d067db7c9b6e0e8ac9307dfe3026d1d
SHA512

21ae2f5695effe8abc6e9b010d3c8453b8d8fac8b08d5e847084b9871fd64c6bcd28dacc3b73eb8c6108d678320c374c25818584eb1a5e0cbbc03e208660ec9e
SSDEEP

24576:/OTuFoSUpzjLJrr4FtnILnSqmdoRdSeUSjguAF11N0i7TwONgV0HL1z9ChftQAgF:hoSUpzjLJYFtnILtmdoRdgSjguA30i7g

Score

10^/10

miner xmrig

Malware Config

Signatures

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	xmrig

Xmrig family
xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.655dcd1018074b16b8e73ceb995b84b0.exe

Files

NEAS.655dcd1018074b16b8e73ceb995b84b0.exe
.exe windows:6 windows x86

1a898b3abef7e0f6d29858320099bf34

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostname
connect
WSACleanup
__WSAFDIsSet
accept
send
ntohs
recv
WSAPoll
WSASetLastError
WSAStartup
select
WSARecvFrom
bind
WSAIoctl
WSASend
shutdown
listen
WSASocketW
getsockname
socket
WSARecv
ioctlsocket
FreeAddrInfoW
GetAddrInfoW
htonl
closesocket
getsockopt
setsockopt
WSAGetLastError
htons

iphlpapi

GetAdaptersAddresses

kernel32

ExitThread
SetFileAttributesW
GetFileAttributesExW
GetConsoleCP
SetStdHandle
GetCommandLineW
GetModuleHandleExW
RtlUnwind
ExitProcess
HeapFree
GetCommandLineA
HeapAlloc
GetStdHandle
SetConsoleMode
GetConsoleMode
OutputDebugStringA
CreateMutexA
ReleaseMutex
GetLastError
CloseHandle
FreeConsole
GetConsoleWindow
MultiByteToWideChar
SetThreadAffinityMask
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetCurrentThread
GetProcAddress
GetModuleHandleW
VirtualFree
VirtualAlloc
LocalAlloc
LocalFree
SetErrorMode
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
CreateIoCompletionPort
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
CreateFileW
DuplicateHandle
QueueUserWorkItem
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
ReadConsoleW
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
WideCharToMultiByte
SetConsoleCursorPosition
GetLongPathNameW
GetShortPathNameW
GetFileAttributesW
GetCurrentDirectoryW
ReadDirectoryChangesW
VerifyVersionInfoA
EnterCriticalSection
GetModuleFileNameW
SetEnvironmentVariableW
LeaveCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
GetSystemInfo
VerSetConditionMask
GetCurrentProcessId
QueryPerformanceCounter
SetConsoleCtrlHandler
Sleep
GetFileType
CreateDirectoryW
ReadFile
SetLastError
WriteFile
DeviceIoControl
RemoveDirectoryW
GetFinalPathNameByHandleW
SetFileTime
ReOpenFile
CreateHardLinkW
GetFileInformationByHandle
SetFilePointerEx
MoveFileExW
CopyFileW
CreateSymbolicLinkW
FlushFileBuffers
SleepConditionVariableCS
TlsSetValue
ReleaseSemaphore
WakeConditionVariable
InitializeConditionVariable
WaitForSingleObject
ResumeThread
SetEvent
TlsAlloc
DeleteCriticalSection
CreateSemaphoreW
TlsGetValue
TlsFree
CreateSemaphoreA
CreateEventA
CancelIo
SetHandleInformation
SetFileCompletionNotificationModes
SetNamedPipeHandleState
CreateNamedPipeW
PeekNamedPipe
CancelSynchronousIo
GetNamedPipeHandleStateA
CancelIoEx
SwitchToThread
ConnectNamedPipe
FormatMessageA
DebugBreak
GetModuleHandleA
LoadLibraryA
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
GetTickCount64
RaiseException
LoadLibraryExW
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
HeapSize
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetEndOfFile
CreateEventW
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
CreateThread

user32

TranslateMessage
ShowWindow
DispatchMessageA
MapVirtualKeyW
GetMessageA

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

nnoykmx
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1a898b3abef7e0f6d29858320099bf34

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

iphlpapi

kernel32

user32

advapi32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 117KB - Virtual size: 117KB

.data Size: 33KB - Virtual size: 39KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 64KB - Virtual size: 65KB

nnoykmx Size: - Virtual size: 4KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 117KB - Virtual size: 117KB

.data
Size: 33KB - Virtual size: 39KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 64KB - Virtual size: 65KB

nnoykmx
Size: - Virtual size: 4KB