Behavioral task
behavioral1
Sample
NEAS.47ba934ecc0428e24e8c94c3194eaa80.exe
Resource
win7-20231020-en
General
-
Target
NEAS.47ba934ecc0428e24e8c94c3194eaa80.exe
-
Size
3.3MB
-
MD5
47ba934ecc0428e24e8c94c3194eaa80
-
SHA1
2914ceeaed77b295bb44c1490ce509d96f6202a9
-
SHA256
9b0d3a6e66f8854212f6fcfcf99acc5ba4e0fe8b8b5c6f705db1282615e9da52
-
SHA512
464a0055020ab05869e10041b267d29e9eb257612059788f6aef0bf29578148364d5f8f50af03a9278bd4a2835df8db7336523bf546305db03fd6c0fbf64db0f
-
SSDEEP
98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWq:SbBeSFke
Malware Config
Signatures
-
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.47ba934ecc0428e24e8c94c3194eaa80.exe
Files
-
NEAS.47ba934ecc0428e24e8c94c3194eaa80.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 1.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 525KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE