xmrig | HEUR-Trojan[.]Win32[.]Miner[.]pef-3538cc0eaf556a02aa73b2796372795bf431f8356e04139e2c7a09bf8c6b7714

General

Target

HEUR-Trojan.Win32.Miner.pef-3538cc0eaf556a02aa73b2796372795bf431f8356e04139e2c7a09bf8c6b7714
Size

2.5MB
MD5

a4f7e6bee10a55175d6faa3ab60cc230
SHA1

84c776e1b3938de46c12d4792aedd0facb8f1224
SHA256

3538cc0eaf556a02aa73b2796372795bf431f8356e04139e2c7a09bf8c6b7714
SHA512

2ea011f814d582dfe37b5ea7ce5ad8738a5dbf36a14378d19bfd25e8f99785fe27cea5316020d9ea67a528f7dd5670dee3702a971d93ca5cb082e40fa5b85bde
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfL3A:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R8

Score

10^/10

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	xmrig

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HEUR-Trojan.Win32.Miner.pef-3538cc0eaf556a02aa73b2796372795bf431f8356e04139e2c7a09bf8c6b7714