xmrig | 7c5fd052b443e7f366e36e8778661271_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
7c5fd052b443e7f366e36e8778661271_JaffaCakes118
Size 1.1MB
Sample240528-kr78rada91
SHA256 ccfb64f4ae7e3b73161c04364528abab7b4d8b73106bb85d6f069c3ecaaf1cba
MD5 7c5fd052b443e7f366e36e8778661271
SHA1 b6418caa18fe688c14c6d87c96155275e0fb4ee9
SHA512 6e9b459634a61612a0246359407b02db648120145f5d0f56e508c4346769b52fe757bc4c9e88fdebacac11e45f73071168dfad6615b0d1c548945df332ebe42f
SSDEEP 24576:F31SZSaMidm23AzTOAV4xhFIaSV5VZZGSDNVwftoJNDBki+4K4zI4VX9wm6fj:FwZSTidmvuAGhFA54qVwfoNDBkirJzIz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

miner xmrig

Malware Config

Signatures

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	xmrig

Xmrig family
xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7c5fd052b443e7f366e36e8778661271_JaffaCakes118

File Explorer

7c5fd052b443e7f366e36e8778661271_JaffaCakes118

.exe 1.1MB

7c5fd052b443e7f366e36e8778661271_JaffaCakes118

IMPHASH f029615e3ff5f1b5bc405d8fef0a66e6
SHA256 ccfb64f4ae7e3b73161c04364528abab7b4d8b73106bb85d6f069c3ecaaf1cba
MD5 7c5fd052b443e7f366e36e8778661271
SHA1 b6418caa18fe688c14c6d87c96155275e0fb4ee9
SHA512 6e9b459634a61612a0246359407b02db648120145f5d0f56e508c4346769b52fe757bc4c9e88fdebacac11e45f73071168dfad6615b0d1c548945df332ebe42f
SSDEEP 24576:F31SZSaMidm23AzTOAV4xhFIaSV5VZZGSDNVwftoJNDBki+4K4zI4VX9wm6fj:FwZSTidmvuAGhFA54qVwfoNDBkirJzIz
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1179648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Conding\xmrig\back\Monero_Loader\Release\xmrig.pdb

kernel32

LoadLibraryW CopyFileW TerminateProcess FileTimeToSystemTime GetModuleFileNameW GetTempPathW GetProcAddress VirtualAllocEx Process32FirstW GetModuleFileNameA Process32NextW CreateToolhelp32Snapshot GetCurrentProcessId GetSystemTime WriteProcessMemory CreateThread SetPriorityClass GetCurrentProcess GetLogicalDriveStringsW GetSystemDirectoryW GetCurrentThread lstrcatA GetEnvironmentVariableA MultiByteToWideChar lstrlenW SetThreadPriority GetShortPathNameA GetLocalTime QueryDosDeviceW lstrcmpiW lstrcatW GetFileTime WinExec DeleteFileW lstrcpyW lstrcpyA InterlockedIncrement GetStdHandle SetHandleCount LocalFree CreateRemoteThread GetModuleHandleW OutputDebugStringW WaitForSingleObject CreateDirectoryW HeapFree InterlockedDecrement GetSystemTimeAsFileTime CreateMutexW GetCommandLineW GetLastError CreateFileW ReadFile WideCharToMultiByte WriteFile CreateProcessW CloseHandle GetSystemInfo GetExitCodeProcess Sleep OpenProcess GetTickCount lstrlenA SetStdHandle WriteConsoleW HeapCreate IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo FlushFileBuffers SetFilePointer HeapReAlloc GetStringTypeW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetOEMCP GetACP GetConsoleMode GetConsoleCP GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc HeapSize GetFileType EncodePointer DecodePointer InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapAlloc GetFileAttributesW ExitProcess HeapSetInformation GetStartupInfoW RaiseException RtlUnwind LCMapStringW InitializeCriticalSectionAndSpinCount

user32

wsprintfA wsprintfW

advapi32

AdjustTokenPrivileges QueryServiceConfigW ControlService UnlockServiceDatabase RegOpenKeyExW QueryServiceStatusEx QueryServiceStatus StartServiceW ChangeServiceConfig2W LockServiceDatabase RegOpenKeyW OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle CreateServiceW LookupPrivilegeValueW GetTokenInformation OpenProcessToken RegSetValueExW RegCloseKey RegisterServiceCtrlHandlerW SetServiceStatus RegDeleteValueW RegCreateKeyExW RegDeleteKeyExW StartServiceCtrlDispatcherW

shell32

SHGetSpecialFolderPathW

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoCreateInstance CoSetProxyBlanket

oleaut32

VariantChangeType VariantInit SysAllocString SysFreeString VariantClear

winhttp

WinHttpReceiveResponse WinHttpSetTimeouts WinHttpSendRequest WinHttpConnect WinHttpCloseHandle WinHttpQueryHeaders WinHttpReadData WinHttpCrackUrl WinHttpOpenRequest WinHttpOpen WinHttpQueryDataAvailable

ws2_32

closesocket socket WSACleanup sendto htons WSAStartup recvfrom inet_addr

psapi

GetProcessImageFileNameW

Name

.text

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

965KB

Virtual Size

974KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

P��[�u�

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

7c5fd052b443e7f366e36e8778661271_JaffaCakes118

kernel32

user32

advapi32

shell32

ole32

oleaut32

winhttp

ws2_32

psapi

generic