xmrig | 53d44678dbed10bccee69a0a9b4c043a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
53d44678dbed10bccee69a0a9b4c043a_JaffaCakes118
Size 2.8MB
Sample240518-ka6zcsbf46
SHA256 155de37e521dc968681f14f5fd3a4479febeb6e5f31f13f03031eb2f8d0c2ebd
MD5 53d44678dbed10bccee69a0a9b4c043a
SHA1 a65fe241b238748aafe058c8ac21ce47ab3e4acd
SHA512 6b2004726d3b4edc1c128bee9a9f4ea24567eafdc2acae8705abf637b09444e245b54574f5e4b13edfed9f834ddc979b4510b841427a4c7ea9684f28a4e05e38
SSDEEP 49152:JFwvxKcXLOmCwT1UyLpKjRXrg6tTTE3grAEXoPXLHI+JmEJFG2RKqQCK3bVjMHxk:JFwZnWKrmVrQgrAAoPXLHIE/g2RKqG3v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx miner xmrig

Malware Config

Signatures

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
static1/unpack001/out.upx	xmrig

Xmrig family
xmrig

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
53d44678dbed10bccee69a0a9b4c043a_JaffaCakes118
unpack001/out.upx

File Explorer

53d44678dbed10bccee69a0a9b4c043a_JaffaCakes118

.exe 2.8MB
out.upx

.exe 8.8MB

53d44678dbed10bccee69a0a9b4c043a_JaffaCakes118

SHA256 155de37e521dc968681f14f5fd3a4479febeb6e5f31f13f03031eb2f8d0c2ebd
MD5 53d44678dbed10bccee69a0a9b4c043a
SHA1 a65fe241b238748aafe058c8ac21ce47ab3e4acd
SHA512 6b2004726d3b4edc1c128bee9a9f4ea24567eafdc2acae8705abf637b09444e245b54574f5e4b13edfed9f834ddc979b4510b841427a4c7ea9684f28a4e05e38
SSDEEP 49152:JFwvxKcXLOmCwT1UyLpKjRXrg6tTTE3grAEXoPXLHI+JmEJFG2RKqQCK3bVjMHxk:JFwZnWKrmVrQgrAAoPXLHIE/g2RKqG3v
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9320608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

generic

count=72, id=260, version=25203,

count=28, id=259, version=25203,

count=186, id=261, version=25203,

count=6, id=199, version=41118,

count=8, id=259, version=24123,

count=117, id=261, version=24123,

count=42, id=260, version=24123,

count=10, id=257, version=25203,

count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=299, id=1, productName=Unmarked objects,

count=3, id=203, version=65501,

count=41, id=264, version=24231,

count=5, id=260, version=24231,

count=35, id=261, version=24231,

count=1, id=256, version=24231,

count=1, id=255, version=24231,

count=1, id=151,

count=1, id=258, version=24231,

out.upx

SHA256 9c8396fd60a8e96f09d37f2ad633d5b3216ae2abe266259cd60b6b52f4db1718
MD5 f57e59e6e58dc3d6a0113682a08648a5
SHA1 6cc05fe9b75235502f7dd2f68dcd59cfc90e4a29
SHA512 1031135279205de79d83acb98e34d0fc70deca8e5de689cc12af1c57cf7998f1ea59dea62e049da042233a724b0d712b817d5d4a8bb9cf22fc8612218f5a71aa
SSDEEP 98304:nd60pIQzNVPGkwSz8dUxdVdqxNZz8pvq/I98pz44Twk8pAiCpf6pPOtC:dvPGkw0xdV0Z2q/IGrTwg/pf6pPO
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

XMRig Miner payload

miner
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

472140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

616KB

Virtual Size

615KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

197KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.nv_fatb

Size

7.9MB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nvFatBi

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

628B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

49KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=72, id=260, version=25203,

count=28, id=259, version=25203,

count=186, id=261, version=25203,

count=6, id=199, version=41118,

count=8, id=259, version=24123,

count=117, id=261, version=24123,

count=42, id=260, version=24123,

count=10, id=257, version=25203,

count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=299, id=1, productName=Unmarked objects,

count=3, id=203, version=65501,

count=41, id=264, version=24231,

count=5, id=260, version=24231,

count=35, id=261, version=24231,

count=1, id=256, version=24231,

count=1, id=255, version=24231,

count=1, id=151,

count=1, id=258, version=24231,