Overview

overview

10

Static

static

10

04b950ca52...18.exe

windows7-x64

10

04b950ca52...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04b950ca5287f735584e8ffe422d3201_JaffaCakes118

  • Size

    1.5MB

  • Sample

    240428-jtbrwsbc67

  • MD5

    04b950ca5287f735584e8ffe422d3201

  • SHA1

    30344df57c6b07b619a142abc2c3a81badcdb46f

  • SHA256

    ed4e144913771b76e8fb0fff4fabe0b3ff69e496894d9fe0ba39d41d18cb5fc2

  • SHA512

    dbacddbe6bce46abef5acca0650f122610da6dd1c34d08c76024170de8a11d5d931af80abb65108f0b0bde6fd96fa9413bf07f63bce2b42ee7916c5cec76269c

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwPay:Lz071uv4BPMkibTIA5CJM

Score
10/10
xmrigminerupx

Malware Config

Targets

    • Target

      04b950ca5287f735584e8ffe422d3201_JaffaCakes118

    • Size

      1.5MB

    • MD5

      04b950ca5287f735584e8ffe422d3201

    • SHA1

      30344df57c6b07b619a142abc2c3a81badcdb46f

    • SHA256

      ed4e144913771b76e8fb0fff4fabe0b3ff69e496894d9fe0ba39d41d18cb5fc2

    • SHA512

      dbacddbe6bce46abef5acca0650f122610da6dd1c34d08c76024170de8a11d5d931af80abb65108f0b0bde6fd96fa9413bf07f63bce2b42ee7916c5cec76269c

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwPay:Lz071uv4BPMkibTIA5CJM

    Score
    10/10
    xmrigminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks