Behavioral task
behavioral1
Sample
8685eb7c70bf3b67a9a0fc208bee98a51ef51d6e3e11d82ef7cbe8cf066a69e2.exe
Resource
win7-20231129-en
General
-
Target
8685eb7c70bf3b67a9a0fc208bee98a51ef51d6e3e11d82ef7cbe8cf066a69e2
-
Size
2.7MB
-
MD5
2c48b279f2e3a127a92c34fb4ca84677
-
SHA1
4bfb958ed6fad70a37af410b6df6a80918a66297
-
SHA256
8685eb7c70bf3b67a9a0fc208bee98a51ef51d6e3e11d82ef7cbe8cf066a69e2
-
SHA512
04d1c46987906fe12cf9ad97f667bf9567d1ea726c20045f3289657d668d35f4470e36dd2038a10100fbf9aa91e0a4d6a36470a6d6eb762b1ce3385e42e15f80
-
SSDEEP
49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R+Z:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RJ
Malware Config
Signatures
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8685eb7c70bf3b67a9a0fc208bee98a51ef51d6e3e11d82ef7cbe8cf066a69e2
Files
-
8685eb7c70bf3b67a9a0fc208bee98a51ef51d6e3e11d82ef7cbe8cf066a69e2.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 1.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 525KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE