Behavioral task
behavioral1
Sample
NEAS.6eb92ae97b326f9aad198246962a9d50.exe
Resource
win7-20230831-en
General
-
Target
NEAS.6eb92ae97b326f9aad198246962a9d50.exe
-
Size
2.2MB
-
MD5
6eb92ae97b326f9aad198246962a9d50
-
SHA1
2f27565d969156cd41122caee6b8d366d8449d71
-
SHA256
233c1c38fce68c5f2ab5ef4089fc844432645995ae0f3d7ba46b483368a6a6c9
-
SHA512
ec68b66a6ed5b182bbf5e6c5416f7f4b8335c1456620525e3c63471001bc9f720ed5b8bf747316c772442dfaaaf5591b542ebd633d046e375b64bdcbd230ed3c
-
SSDEEP
49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+A8Jh1Aa1dFhEv4:BemTLkNdfE0pZrn
Malware Config
Signatures
-
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.6eb92ae97b326f9aad198246962a9d50.exe
Files
-
NEAS.6eb92ae97b326f9aad198246962a9d50.exe.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 724KB - Virtual size: 3.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 272KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE