Overview

overview

10

Static

static

1

ExecPubg.exe

windows7-x64

10

ExecPubg.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ExecPubg.exe

  • Size

    2.8MB

  • Sample

    240506-wte6jadb3z

  • MD5

    ccdcccec419d5138153225379d909f16

  • SHA1

    1dd689b6f27acf6d293c7f07b4b780053aa4dfeb

  • SHA256

    ba1feee88bb96cdca22818dc5e450219ba77d0a5ff69d58f7c06140763ef6592

  • SHA512

    9feee655a811442efcf3775af476c2fee0e3c424872a57192c848ac077198c9ab4b84e21cb4b897293864924300df4dc4750910c943ce6917fcd439c7467e949

  • SSDEEP

    49152:Em7utXzs0b/50C8FD2c7um6q1Ro6os7yh/YpE1Bz7KO6LH/zXZTjV0k/nrVxod:E2es09SFDqHJlV/YpA3T6LLXZTjyk/Qd

Score
10/10
xmrigzgratminerpersistenceratupx

Malware Config

Targets

    • Target

      ExecPubg.exe

    • Size

      2.8MB

    • MD5

      ccdcccec419d5138153225379d909f16

    • SHA1

      1dd689b6f27acf6d293c7f07b4b780053aa4dfeb

    • SHA256

      ba1feee88bb96cdca22818dc5e450219ba77d0a5ff69d58f7c06140763ef6592

    • SHA512

      9feee655a811442efcf3775af476c2fee0e3c424872a57192c848ac077198c9ab4b84e21cb4b897293864924300df4dc4750910c943ce6917fcd439c7467e949

    • SSDEEP

      49152:Em7utXzs0b/50C8FD2c7um6q1Ro6os7yh/YpE1Bz7KO6LH/zXZTjV0k/nrVxod:E2es09SFDqHJlV/YpA3T6LLXZTjyk/Qd

    Score
    10/10
    zgratpersistenceratxmrigminerupx

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks