Behavioral task
behavioral1
Sample
093f04fb7385068f8e73e5d0bce7f6e548080bc0bffa4de5c3a5894148c52a46.exe
Resource
win7-20240221-en
General
-
Target
093f04fb7385068f8e73e5d0bce7f6e548080bc0bffa4de5c3a5894148c52a46
-
Size
2.7MB
-
MD5
413e5ae63e95202420db36924763c505
-
SHA1
a73f48d06cbae1fe920c8787b99e3eb4a5e94906
-
SHA256
093f04fb7385068f8e73e5d0bce7f6e548080bc0bffa4de5c3a5894148c52a46
-
SHA512
391f2c45b973c6afa347d36b7cb5d08f59d61cc631eb52c5e75a94865f08f4eb03e534b0d66fe0c60d66c4fad4ad0c496dff9d63f9db87f0dc13e67166d842b8
-
SSDEEP
49152:N0wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjcz8DzcCNfeT5J0aXiJvS:N0GnJMOWPClFdx6e0EALKWVTffZiPAcE
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 093f04fb7385068f8e73e5d0bce7f6e548080bc0bffa4de5c3a5894148c52a46
Files
-
093f04fb7385068f8e73e5d0bce7f6e548080bc0bffa4de5c3a5894148c52a46.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 1.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 525KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE