Behavioral task
behavioral1
Sample
53bf007ce7ab6c7ea2019b3376805bcca712a21f8112dd1054e8309d45f1f42e.exe
Resource
win7-20240221-en
General
-
Target
53bf007ce7ab6c7ea2019b3376805bcca712a21f8112dd1054e8309d45f1f42e
-
Size
2.7MB
-
MD5
9a1ee104de61d51a9e771455083d294f
-
SHA1
bf5b55e347408d5d9f97af611fa3997b2ffa3b69
-
SHA256
53bf007ce7ab6c7ea2019b3376805bcca712a21f8112dd1054e8309d45f1f42e
-
SHA512
a790e4222e42ac4622e04b5144c0e1113c540791c18ab5f38716772b353dc1d457d7b79bc71f3bbc3defdc0af77630bba4e7455fa6e94bd31ede083602c3dd73
-
SSDEEP
49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkiFGlObsz3W:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RF
Malware Config
Signatures
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 53bf007ce7ab6c7ea2019b3376805bcca712a21f8112dd1054e8309d45f1f42e
Files
-
53bf007ce7ab6c7ea2019b3376805bcca712a21f8112dd1054e8309d45f1f42e.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 1.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 525KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE