Overview

overview

10

Static

static

10

20b253af92...40.exe

windows7-x64

10

20b253af92...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20b253af92ef4e35e92e539337b736fb0d5818e68e821ed7321a572b13f5bd40

  • Size

    2.0MB

  • Sample

    240527-ygqgvafg4s

  • MD5

    1b0d7f0a8060c50f507b308ea707d380

  • SHA1

    8419f3df79e1afd8721fcf08896c041d932a00a1

  • SHA256

    20b253af92ef4e35e92e539337b736fb0d5818e68e821ed7321a572b13f5bd40

  • SHA512

    942a8d8cc7a5c9cb5da312c4783cd9cd4de5ae28a5dbcb9e88a9f344ae6f4f7a638207fb9a98ff6b98cc714c61ebc58176ba5ed73787ff552632bafefe0cd199

  • SSDEEP

    49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+Agr6SNas/:BemTLkNdfE0pZrwq

Score
10/10
kpotxmrigminerstealertrojanupx

Malware Config

Targets

    • Target

      20b253af92ef4e35e92e539337b736fb0d5818e68e821ed7321a572b13f5bd40

    • Size

      2.0MB

    • MD5

      1b0d7f0a8060c50f507b308ea707d380

    • SHA1

      8419f3df79e1afd8721fcf08896c041d932a00a1

    • SHA256

      20b253af92ef4e35e92e539337b736fb0d5818e68e821ed7321a572b13f5bd40

    • SHA512

      942a8d8cc7a5c9cb5da312c4783cd9cd4de5ae28a5dbcb9e88a9f344ae6f4f7a638207fb9a98ff6b98cc714c61ebc58176ba5ed73787ff552632bafefe0cd199

    • SSDEEP

      49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+Agr6SNas/:BemTLkNdfE0pZrwq

    Score
    10/10
    kpotxmrigminerstealertrojanupx

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • UPX dump on OEP (original entry point)

    • XMRig Miner payload

      miner

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks