Overview

overview

10

Static

static

10

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    5.0MB

  • Sample

    240225-pf9pnabb92

  • MD5

    a3fb2b623f4490ae1979fea68cfe36d6

  • SHA1

    34bec167e0f95ecc36761f77c93c1229c2c5d1f4

  • SHA256

    3bc9c1d7f87f71c9e98fac63c2f10d2651f51848082a85d6b3550649e4289d56

  • SHA512

    370b23364bcf8f07aa951c1c6a9d6b03b516db8fd7444d25087ad8071c54bb06fd50ce311a205e0770211167728d86516e934a39a606f0bf0c9fbdd13dca7912

  • SSDEEP

    98304:xrd0tlZ+I89l7cGcGI4G/Mul2rq/aReDkizMeQUz4:x+tlQ4zGk/Mul2rVe4iwVU

Score
10/10
xmrigzgratminerratupx

Malware Config

Targets

    • Target

      tmp

    • Size

      5.0MB

    • MD5

      a3fb2b623f4490ae1979fea68cfe36d6

    • SHA1

      34bec167e0f95ecc36761f77c93c1229c2c5d1f4

    • SHA256

      3bc9c1d7f87f71c9e98fac63c2f10d2651f51848082a85d6b3550649e4289d56

    • SHA512

      370b23364bcf8f07aa951c1c6a9d6b03b516db8fd7444d25087ad8071c54bb06fd50ce311a205e0770211167728d86516e934a39a606f0bf0c9fbdd13dca7912

    • SSDEEP

      98304:xrd0tlZ+I89l7cGcGI4G/Mul2rq/aReDkizMeQUz4:x+tlQ4zGk/Mul2rVe4iwVU

    Score
    10/10
    xmrigzgratminerratupx

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks