Overview

overview

10

Static

static

3

39899e500b...28.exe

windows7-x64

10

39899e500b...28.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    4df295e5480362e75b85e46693da286f.bin

  • Size

    6.6MB

  • Sample

    240313-bv2eyaaf45

  • MD5

    848aa83ac87f6f8e11ff1b6a83f56cd2

  • SHA1

    8b99050d8b9a03263e3404e02c444a709f4ca9ee

  • SHA256

    5d1f318d5d79aead0fba2d779fcb2859fffafb35075c6481b5444202c5b90128

  • SHA512

    a968a58825e73c63dfb1bc552e0bbd87c34bf85a820ce1d9c91316398638f984a4d37a2b4dd48e302053806ba1c121f698ef95eda92a1254736dd0c48247968c

  • SSDEEP

    196608:mV26NaRbzjGsdl1MClGF8j7jyU+oLpa3k:i5CzGsNNlGajTE3k

Score
10/10
xmrigevasionminerpersistenceupx

Malware Config

Targets

    • Target

      39899e500bdfd7374f1e70fbfac44d6426e7b4eb4970c3ff49a3515f76e13728.exe

    • Size

      7.0MB

    • MD5

      4df295e5480362e75b85e46693da286f

    • SHA1

      e791d85958043807505d6d515352884513d8d8dd

    • SHA256

      39899e500bdfd7374f1e70fbfac44d6426e7b4eb4970c3ff49a3515f76e13728

    • SHA512

      97e2add3ea23a8196eff5ed50bc08a4e50a48d2629c8f64afe19a0280adb947a2287735ecc4c32b59d7b1722a530120cf310fdecc4d89671843a3318128983f3

    • SSDEEP

      196608:vPMf4f+QSvWLEesxAv12VI4yBj5w6C/1/pejflOy+:n4oRvLNsC1c8jKJejfd

    Score
    10/10
    xmrigevasionminerpersistenceupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Creates new service(s)

      persistence

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks