Behavioral task
behavioral1
Sample
c5b88e03d2069488f0c0c3c20b0aa4c0887d30d7e9fb9b9c4fd1226f213170b5.exe
Resource
win7-20240221-en
General
-
Target
c5b88e03d2069488f0c0c3c20b0aa4c0887d30d7e9fb9b9c4fd1226f213170b5
-
Size
2.5MB
-
MD5
d3ac7a8e9ea6231d82194687409e7ea0
-
SHA1
8cf6f9b31889c1d4583dd69166d6cac84d7de0d7
-
SHA256
c5b88e03d2069488f0c0c3c20b0aa4c0887d30d7e9fb9b9c4fd1226f213170b5
-
SHA512
3d411eb81e412bebfe8cdf3e915713d4ab72baf6ad09e470c37bed51db618c4f4eb4fe0ed3b135816f19d2ec283992fa05c201b3366614d4abd858024a0a9566
-
SSDEEP
49152:N0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzcDwq6xkGA78LR7I:N0GnJMOWPClFdx6e0EALKWVTffZiPAcw
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c5b88e03d2069488f0c0c3c20b0aa4c0887d30d7e9fb9b9c4fd1226f213170b5
Files
-
c5b88e03d2069488f0c0c3c20b0aa4c0887d30d7e9fb9b9c4fd1226f213170b5.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 1.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 525KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE