Behavioral task
behavioral1
Sample
b7dbd662a32782d86a62e7a3a329bee27f8ecc4f863687dd71b97bba4c4ee1aa.exe
Resource
win7-20240220-en
General
-
Target
b7dbd662a32782d86a62e7a3a329bee27f8ecc4f863687dd71b97bba4c4ee1aa
-
Size
2.9MB
-
MD5
0a0bde37b612656f158cfb9da6230e23
-
SHA1
c886f27448d4165b027bc0030ba7b3e4989ad21e
-
SHA256
b7dbd662a32782d86a62e7a3a329bee27f8ecc4f863687dd71b97bba4c4ee1aa
-
SHA512
41165ccac67c385fbc6dbad05193aa2366499b2cd0c9d2c71c2e40ad4f2af3b992347bfe1babfb16c903c071222f01ccdb7de82a9125277c391ff03db8479f9d
-
SSDEEP
49152:N0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzzxTMS8Tg0FdC6Rp:N0GnJMOWPClFdx6e0EALKWVTffZiPAco
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7dbd662a32782d86a62e7a3a329bee27f8ecc4f863687dd71b97bba4c4ee1aa
Files
-
b7dbd662a32782d86a62e7a3a329bee27f8ecc4f863687dd71b97bba4c4ee1aa.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 1.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 525KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE