xmrig | 7b771326686fd1f38c2f782fe4b16b82_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
7b771326686fd1f38c2f782fe4b16b82_JaffaCakes118
Size 2.4MB
Sample240528-dkawcade64
SHA256 dec1ca7a1142eaf9a7c6d37b340860be9d3923b9b7c417a7c3ea8411c5cef128
MD5 7b771326686fd1f38c2f782fe4b16b82
SHA1 81a46d760eb945d86216199e12fd8531dd496ee9
SHA512 252a968a3d767759913abeddc847e6bb31a66dcc444f038a172a949d7b5f865cde4064e1664506bbb94569d1c4872ce79b5ab87fbd1c1d11caf16ec0be679b9d
SSDEEP 49152:gRM551cv/cPc/eVdYTK+Av8q/+QZ6oCBxhx4QEC8Txru9231QGl5fnTv602:33O/Uc25v8qm2Qx3tEC4x6kW8L6J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

miner xmrig

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
static1/unpack001/xmrig-notls.exe	xmrig
static1/unpack001/xmrig.exe	xmrig

Xmrig family
xmrig

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/xmrig-notls.exe
unpack001/xmrig.exe

File Explorer

7b771326686fd1f38c2f782fe4b16b82_JaffaCakes118

.zip 2.4MB
config.json

941B
start.cmd

27B
xmrig-notls.exe

.exe 1.5MB
xmrig.exe

.exe 4.3MB

7b771326686fd1f38c2f782fe4b16b82_JaffaCakes118

SHA256 dec1ca7a1142eaf9a7c6d37b340860be9d3923b9b7c417a7c3ea8411c5cef128
MD5 7b771326686fd1f38c2f782fe4b16b82
SHA1 81a46d760eb945d86216199e12fd8531dd496ee9
SHA512 252a968a3d767759913abeddc847e6bb31a66dcc444f038a172a949d7b5f865cde4064e1664506bbb94569d1c4872ce79b5ab87fbd1c1d11caf16ec0be679b9d
SSDEEP 49152:gRM551cv/cPc/eVdYTK+Av8q/+QZ6oCBxhx4QEC8Txru9231QGl5fnTv602:33O/Uc25v8qm2Qx3tEC4x6kW8L6J
MD5 SHA1 SHA512 SSDEEP

xmrig-notls.exe

IMPHASH 736b5e0b92830e97e1ebc821da4a415a
SHA256 2d35980542b603e02832c774ce0d0bc22e269f066bcdff20a919dcbd23e2ef2a
MD5 687fb2c5d54c4882e260a6ecd705674e
SHA1 0a3fef306d9675379d0c0a01c660eb1b0192d026
SHA512 53836cfadf741d2beeb1e77bb89cf62fc73ee08ea0e89ee1687da49e691e86a9c968dfc8bfd0dbc522cc3efc2bafbc22d40fd475f300a711f0c73c47a940c1ec
SSDEEP 24576:3xAlNkcF9D6tlhGF1emnRRVJ9l7jjb6pQYOx0Qx8Huy/WihmclCnEQW:3xAkMD+OF1ekRRVJ9l7M3Ox0Qxzat
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5376

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CryptAcquireContextA CryptGenRandom CryptReleaseContext GetTokenInformation GetUserNameW LookupPrivilegeValueW LsaAddAccountRights LsaClose LsaOpenPolicy OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW

iphlpapi

GetAdaptersAddresses

kernel32

AddVectoredExceptionHandler AssignProcessToJobObject CancelIo CloseHandle ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventA CreateFileA CreateFileW CreateHardLinkW CreateIoCompletionPort CreateJobObjectW CreateNamedPipeA CreateNamedPipeW CreateProcessW CreateSemaphoreA CreateSemaphoreW CreateToolhelp32Snapshot DebugBreak DeleteCriticalSection DeviceIoControl DuplicateHandle EnterCriticalSection FileTimeToSystemTime FillConsoleOutputAttribute FillConsoleOutputCharacterW FlushFileBuffers FormatMessageA FreeConsole FreeLibrary GetConsoleCursorInfo GetConsoleMode GetConsoleScreenBufferInfo GetConsoleTitleW GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileType GetHandleInformation GetLastError GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNamedPipeHandleStateA GetNumberOfConsoleInputEvents GetProcAddress GetProcessAffinityMask GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatus GetShortPathNameW GetStartupInfoA GetStartupInfoW GetStdHandle GetSystemInfo GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GlobalMemoryStatusEx InitializeCriticalSection InitializeCriticalSectionAndSpinCount IsDBCSLeadByteEx IsDebuggerPresent LCMapStringW LeaveCriticalSection LoadLibraryA LocalAlloc LocalFree MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA PeekNamedPipe PostQueuedCompletionStatus Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency QueueUserWorkItem RaiseException ReadConsoleInputW ReadConsoleW ReadDirectoryChangesW ReadFile RegisterWaitForSingleObject ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread SetConsoleCtrlHandler SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleTextAttribute SetConsoleTitleW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetEvent SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessAffinityMask SetSystemTime SetThreadAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnregisterWait UnregisterWaitEx VerSetConditionMask VerifyVersionInfoA VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WideCharToMultiByte WriteConsoleInputW WriteConsoleW WriteFile

msvcrt

__argv __dllonexit __doserrno __getmainargs __initenv __lconv_init __mb_cur_max __set_app_type __setusermatherr _acmdln _aligned_free _aligned_malloc _amsg_exit _beginthreadex _cexit _close _endthreadex _errno _close _exit _fdopen _fmode _get_osfhandle _initterm _iob _lock _lseeki64 _onexit _open_osfhandle _read _setjmp3 _snwprintf _strdup _stricmp _strnicmp _ultoa _umask _unlock _vsnprintf _wchmod _wcsdup _wcsnicmp _wcsrev _wmkdir _write _write _wrmdir abort atoi calloc exit fflush fopen fprintf fputc fputs fread free fwprintf fwrite getenv gmtime islower isspace isupper localeconv localtime longjmp malloc memchr memcmp memcpy memmove memset printf qsort raise rand realloc setlocale signal sprintf srand strchr strcmp strcpy strerror strlen strncmp strncpy strrchr strstr strtol strtoul time vfprintf wcschr wcscpy wcslen wcsncmp wcsncpy wcspbrk wcsrchr wcstombs

psapi

GetProcessMemoryInfo

user32

DispatchMessageA GetMessageA MapVirtualKeyW MessageBoxW SetWinEventHook ShowWindow TranslateMessage

userenv

GetUserProfileDirectoryW

ws2_32

FreeAddrInfoW GetAddrInfoW WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSARecv WSARecvFrom WSASend WSASendTo WSASetLastError WSASocketW WSAStartup __WSAFDIsSet accept bind closesocket connect gethostname getpeername getsockname getsockopt htonl htons ioctlsocket listen ntohs recv select send setsockopt shutdown socket

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

xmrig.exe

IMPHASH a3daf37280d7b8c3af8cb9afa25510d2
SHA256 586b81e455ed0aa7623507b0307ba34afdc2ff3494a822cbf1fcc0c1a86ac974
MD5 b629bbb9abbe1f8c94d3f6ada44d1432
SHA1 b37e4ba8e0a828bf3e4d818232d29221ce2a04b7
SHA512 cbfd9cc8b4e7fff0cb00c7deb8a93f66b92c0a3f308a8d2ae82f5952abd37efd1a1f8e6cf6333f2b9d193223b570bec504d43ed15393575abe10e862ecb6f483
SSDEEP 98304:1QbaiDfmpVWbbd2GD06nh7FaG+odh3edtS5I55842jPrSXatqpj5E:1oaiDfmpebdND0mhZahof3ctS+5842jG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5376

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CryptAcquireContextA CryptAcquireContextW CryptCreateHash CryptDecrypt CryptDestroyHash CryptDestroyKey CryptEnumProvidersW CryptExportKey CryptGenRandom CryptGetProvParam CryptGetUserKey CryptReleaseContext CryptSetHashParam CryptSignHashW DeregisterEventSource GetTokenInformation GetUserNameW LookupPrivilegeValueW LsaAddAccountRights LsaClose LsaOpenPolicy OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW RegisterEventSourceW ReportEventW

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

iphlpapi

GetAdaptersAddresses

kernel32

AddVectoredExceptionHandler AssignProcessToJobObject CancelIo CloseHandle ConnectNamedPipe ConvertFiberToThread ConvertThreadToFiber CopyFileW CreateDirectoryW CreateEventA CreateFiber CreateFileA CreateFileW CreateHardLinkW CreateIoCompletionPort CreateJobObjectW CreateNamedPipeA CreateNamedPipeW CreateProcessW CreateSemaphoreA CreateSemaphoreW CreateToolhelp32Snapshot DebugBreak DeleteCriticalSection DeleteFiber DeviceIoControl DuplicateHandle EnterCriticalSection FileTimeToSystemTime FillConsoleOutputAttribute FillConsoleOutputCharacterW FindClose FindFirstFileW FindNextFileW FlushFileBuffers FormatMessageA FormatMessageW FreeConsole FreeLibrary GetConsoleCursorInfo GetConsoleMode GetConsoleScreenBufferInfo GetConsoleTitleW GetConsoleWindow GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileType GetHandleInformation GetLastError GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeHandleStateA GetNumberOfConsoleInputEvents GetProcAddress GetProcessAffinityMask GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatus GetShortPathNameW GetStartupInfoA GetStartupInfoW GetStdHandle GetSystemInfo GetSystemTime GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetVersion GlobalMemoryStatusEx InitializeCriticalSection InitializeCriticalSectionAndSpinCount IsDBCSLeadByteEx IsDebuggerPresent LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA PeekNamedPipe PostQueuedCompletionStatus Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency QueueUserWorkItem RaiseException ReadConsoleA ReadConsoleInputW ReadConsoleW ReadDirectoryChangesW ReadFile RegisterWaitForSingleObject ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread SetConsoleCtrlHandler SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleTextAttribute SetConsoleTitleW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetEvent SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessAffinityMask SetSystemTime SetThreadAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread SwitchToFiber SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnregisterWait UnregisterWaitEx VerSetConditionMask VerifyVersionInfoA VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WideCharToMultiByte WriteConsoleInputW WriteConsoleW WriteFile

msvcrt

__argv __dllonexit __doserrno __getmainargs __initenv __lconv_init __mb_cur_max __set_app_type __setusermatherr _acmdln _aligned_free _aligned_malloc _amsg_exit _beginthreadex _cexit _close _endthreadex _errno _close _exit _fdopen _fileno _fmode _get_osfhandle _initterm _iob _lock _lseeki64 _onexit _open_osfhandle _read _setjmp3 _setmode _snwprintf _stat _strdup _strdup _stricmp _strnicmp _ultoa _umask _unlock _vsnprintf _vsnwprintf _wchmod _wcsdup _wcsnicmp _wcsrev _wfopen _wmkdir _write _write _wrmdir abort atoi calloc exit fclose feof ferror fflush fgets fopen fprintf fputc fputs fread free fseek ftell fwprintf fwrite getenv gmtime islower isspace isupper localeconv localtime longjmp malloc memchr memcmp memcpy memmove memset printf qsort raise rand realloc setlocale signal sprintf srand sscanf strcat strchr strcmp strcpy strcspn strerror strlen strncmp strncpy strrchr strspn strstr strtol strtoul time vfprintf wcschr wcscmp wcscpy wcslen wcsncmp wcsncpy wcspbrk wcsrchr wcsstr wcstombs

psapi

GetProcessMemoryInfo

user32

DispatchMessageA GetMessageA GetProcessWindowStation GetUserObjectInformationW MapVirtualKeyW MessageBoxW SetWinEventHook ShowWindow TranslateMessage

userenv

GetUserProfileDirectoryW

ws2_32

FreeAddrInfoW GetAddrInfoW WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSARecv WSARecvFrom WSASend WSASendTo WSASetLastError WSASocketW WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname gethostname getnameinfo getpeername getsockname getsockopt htonl htons ioctlsocket listen ntohs recv select send setsockopt shutdown socket

Name

.text

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

507KB

Virtual Size

506KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

442KB

Virtual Size

442KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

7b771326686fd1f38c2f782fe4b16b82_JaffaCakes118

config.json

start.cmd

xmrig-notls.exe

advapi32

iphlpapi

kernel32

msvcrt

psapi

user32

userenv

ws2_32

generic

xmrig.exe

advapi32

crypt32

iphlpapi

kernel32

msvcrt

psapi

user32

userenv

ws2_32

generic