xmrig | NEAS[.]21b3125a6fc806eef5028416475d3fb0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.21b3125a6fc806eef5028416475d3fb0.exe
Size

1.7MB
MD5

21b3125a6fc806eef5028416475d3fb0
SHA1

f071ab6368f50d1e5e8177818e15116a97d0bee5
SHA256

871381b7d13eff0f77a631079a9d487c3a7aff8ee300ebb45cc7e5ee55903c27
SHA512

d427f220863a221bfeba414e3e9db1e6fd095ab83b9af2f66bd9bc80dc50d0e44a0a0c960cd80c8e56c8fe33dac558c209b4136562d4a7125a87cca11a57cf18
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIKF/+zYOKGyp15M:GemTLkNdfE0pZa9

Score

10^/10

miner xmrig

Malware Config

Signatures

XMRig Miner payload 1 IoCs

resource	yara_rule
sample	xmrig

Xmrig family
xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.21b3125a6fc806eef5028416475d3fb0.exe

Files

NEAS.21b3125a6fc806eef5028416475d3fb0.exe
.exe windows:6 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 619KB - Virtual size: 619KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_TEXT_CN
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_TEXT_CN
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ