Overview

overview

10

Static

static

3

winprofile

windows7-x64

8

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

  • Size

    2.5MB

  • Sample

    240201-fhtlsadfap

  • MD5

    ffada57f998ed6a72b6ba2f072d2690a

  • SHA1

    6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

  • SHA256

    677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

  • SHA512

    1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

  • SSDEEP

    49152:UjBP3/qGrdNJ8VZFhY++Yk/4aLq8wH7mm6qJsSRRjyl:aBPvfrAZF28k/RLbwH7mvcRRjy

Score
10/10
xmrigevasionminerpersistenceupx

Malware Config

Targets

    • Target

      677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

    • Size

      2.5MB

    • MD5

      ffada57f998ed6a72b6ba2f072d2690a

    • SHA1

      6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

    • SHA256

      677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

    • SHA512

      1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

    • SSDEEP

      49152:UjBP3/qGrdNJ8VZFhY++Yk/4aLq8wH7mm6qJsSRRjyl:aBPvfrAZF28k/RLbwH7mvcRRjy

    Score
    10/10
    evasionpersistencexmrigminerupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Creates new service(s)

      persistence

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks