Behavioral task
behavioral1
Sample
NEAS.579babf92c11eff389f576f9fe018700.exe
Resource
win7-20231020-en
General
-
Target
NEAS.579babf92c11eff389f576f9fe018700.exe
-
Size
2.8MB
-
MD5
579babf92c11eff389f576f9fe018700
-
SHA1
c3e1d62b245f52a89e8a12c6db0e00fa56ef95e3
-
SHA256
58bc0f1465ae356c2859bad1367f40661d1161005985516280d7b2e5f2a25d79
-
SHA512
89591f26c8725b855785bd7654c901ee6d7b1678aaeffb06e1b2fd99302ae37adf7e5a6a83ead1df35b1f399e5baa8dc607d3c9dfd9f55f0ef1f0525b0696dea
-
SSDEEP
49152:BezaTF8FcNkNdfE0pZ9ozt4wIV56uL3pgrCEdMKPFoTzDVmloQr9Y:BemTLkNdfE0pZrV56utgpPFox
Malware Config
Signatures
-
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.579babf92c11eff389f576f9fe018700.exe
Files
-
NEAS.579babf92c11eff389f576f9fe018700.exe.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 724KB - Virtual size: 3.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 272KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE