xmrig | HEUR-Trojan[.]Win32[.]Miner[.]pef-ab5f86d966fbdaf86a50df52fec4ca75f8fc44633e9f582b42c9d735efab0bba

General

Target

HEUR-Trojan.Win32.Miner.pef-ab5f86d966fbdaf86a50df52fec4ca75f8fc44633e9f582b42c9d735efab0bba
Size

2.7MB
MD5

c1972a44062054d013a2c20cdae54a50
SHA1

a2006d1a7aae9b04f9d19c4ba57f672e819ab5da
SHA256

ab5f86d966fbdaf86a50df52fec4ca75f8fc44633e9f582b42c9d735efab0bba
SHA512

a8c693e6c9de68f7e974c20376c170c821668809476f5ab2fc07188ef726ce5f57e1c3dfeb8c3914e00df96f82866ded62d90dab871a3fdcf7145c63aa9bbb45
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CO7fLaDi:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R0

Score

10^/10

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	xmrig

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
HEUR-Trojan.Win32.Miner.pef-ab5f86d966fbdaf86a50df52fec4ca75f8fc44633e9f582b42c9d735efab0bba