xmrig | 86d1f4150837ebe494a9b2aeb0e8ea59_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

86d1f4150837ebe494a9b2aeb0e8ea59_JaffaCakes118
Size

838KB
MD5

86d1f4150837ebe494a9b2aeb0e8ea59
SHA1

32f01451765f749bb6510c537f2f60cb72a267d3
SHA256

13c119694715cd7f3943b639e61e2e34af1abdb6916081805f6660a4561a0825
SHA512

ce689894d68c5f7bb4267143a6325dd64347a7ef747a2090b944dfc991a6852825f7dc9d5e5301af934460acccc44764d6e31ef07dad98fe4474b76158d580a3
SSDEEP

12288:VTdN0QfULSCbvowf6xUMbjOugB6txEt8+ooVBNJAUl4RGjemqsgHm/gAF:9daQc2kWmCgVBNJAUlAG6mVAO

Score

10^/10

miner xmrig

Malware Config

Signatures

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	xmrig

Xmrig family
xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
86d1f4150837ebe494a9b2aeb0e8ea59_JaffaCakes118

Files

86d1f4150837ebe494a9b2aeb0e8ea59_JaffaCakes118
.exe windows:6 windows x64 arch:x64

53c6f0d55ce0e2d963589577fad2d6c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

gethostname
connect
WSACleanup
__WSAFDIsSet
accept
send
ntohs
recv
WSAPoll
WSASetLastError
WSAStartup
select
WSARecvFrom
htonl
bind
WSAIoctl
WSASend
shutdown
listen
WSASocketW
getsockname
socket
WSARecv
ioctlsocket
FreeAddrInfoW
GetAddrInfoW
closesocket
getsockopt
setsockopt
WSAGetLastError
htons

iphlpapi

GetAdaptersAddresses

kernel32

HeapReAlloc
GetACP
GetModuleFileNameA
CompareStringW
HeapFree
HeapAlloc
GetModuleHandleExW
ExitThread
SetFileAttributesW
GetFileAttributesExW
ExitProcess
GetConsoleCP
SetStdHandle
GetStdHandle
SetConsoleMode
GetConsoleMode
CloseHandle
FreeConsole
GetConsoleWindow
SetThreadAffinityMask
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetCurrentThread
GetProcAddress
GetModuleHandleW
VirtualFree
VirtualAlloc
LocalAlloc
GetLastError
LocalFree
SetConsoleCtrlHandler
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
PostQueuedCompletionStatus
Sleep
SetErrorMode
GetQueuedCompletionStatus
CreateIoCompletionPort
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
CreateFileW
DuplicateHandle
QueueUserWorkItem
MultiByteToWideChar
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
ReadConsoleW
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
WideCharToMultiByte
SetConsoleCursorPosition
CreateDirectoryW
ReadFile
SetLastError
WriteFile
DeviceIoControl
RemoveDirectoryW
SetFileTime
CreateHardLinkW
GetFileAttributesW
SetFilePointerEx
MoveFileExW
CopyFileW
FlushFileBuffers
GetLongPathNameW
GetShortPathNameW
GetCurrentDirectoryW
ReadDirectoryChangesW
GetFileType
TlsSetValue
ReleaseSemaphore
WaitForMultipleObjects
WaitForSingleObject
ResumeThread
SetEvent
TlsAlloc
ResetEvent
DeleteCriticalSection
CreateSemaphoreW
TlsGetValue
TlsFree
CreateSemaphoreA
CreateEventA
CancelIo
SetHandleInformation
VerifyVersionInfoA
GetModuleFileNameW
QueryPerformanceFrequency
GetSystemInfo
GetCurrentProcessId
QueryPerformanceCounter
FormatMessageA
DebugBreak
SetNamedPipeHandleState
CreateNamedPipeW
PeekNamedPipe
GetNamedPipeHandleStateA
SwitchToThread
ConnectNamedPipe
GetModuleHandleA
LoadLibraryA
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
GetTickCount64
RaiseException
GetCommandLineW
GetCommandLineA
RtlPcToFileHeader
RtlUnwindEx
GetTimeZoneInformation
HeapSize
GetProcessHeap
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetStringTypeW
DecodePointer
GetFileInformationByHandle
VerSetConditionMask
CreateEventW
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
CreateThread
EncodePointer
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW

user32

TranslateMessage
ShowWindow
DispatchMessageA
MapVirtualKeyW
GetMessageA

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation

Sections

.text
Size: 632KB - Virtual size: 632KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

53c6f0d55ce0e2d963589577fad2d6c6

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

iphlpapi

kernel32

user32

advapi32

Sections

.text Size: 632KB - Virtual size: 632KB

.rdata Size: 128KB - Virtual size: 127KB

.data Size: 49KB - Virtual size: 58KB

.pdata Size: 22KB - Virtual size: 22KB

.rsrc Size: 1KB - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 632KB - Virtual size: 632KB

.rdata
Size: 128KB - Virtual size: 127KB

.data
Size: 49KB - Virtual size: 58KB

.pdata
Size: 22KB - Virtual size: 22KB

.rsrc
Size: 1KB - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 3KB