Overview

overview

10

Static

static

3

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    2.5MB

  • Sample

    231210-wx953shfdj

  • MD5

    57ffc58217a06cee47323a2fdf337da4

  • SHA1

    a68e4d48bf9cb79adfac09808a49a1dca11aa5b9

  • SHA256

    83a324111ace2b17e6b5d1e561cd2c3a640ac8e1e548351990e985ddb097ccef

  • SHA512

    bc073cd8dcaaf51a006b930036ca8aced6cdcb1dfe6ec55b9089375156a8cd34658ba18c3b3400ccbe470693493812c9afb8992ed9aa7446d9d6605b4bc25f4e

  • SSDEEP

    49152:dTNaLsxLy06NWtWN1u9Ij18Ca5Ym0+XezmIoq9sWIOCY3h3zUeW7tesTex9Xr:5NtWLNW+49A8C3mpemp/8dzU77teN

Score
10/10
xmrigevasionminerpersistenceupx

Malware Config

Targets

    • Target

      tmp

    • Size

      2.5MB

    • MD5

      57ffc58217a06cee47323a2fdf337da4

    • SHA1

      a68e4d48bf9cb79adfac09808a49a1dca11aa5b9

    • SHA256

      83a324111ace2b17e6b5d1e561cd2c3a640ac8e1e548351990e985ddb097ccef

    • SHA512

      bc073cd8dcaaf51a006b930036ca8aced6cdcb1dfe6ec55b9089375156a8cd34658ba18c3b3400ccbe470693493812c9afb8992ed9aa7446d9d6605b4bc25f4e

    • SSDEEP

      49152:dTNaLsxLy06NWtWN1u9Ij18Ca5Ym0+XezmIoq9sWIOCY3h3zUeW7tesTex9Xr:5NtWLNW+49A8C3mpemp/8dzU77teN

    Score
    10/10
    xmrigevasionminerpersistenceupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Creates new service(s)

      persistence

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks