Overview

overview

10

Static

static

10

064d2bd707...84.exe

windows7-x64

10

064d2bd707...84.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784

  • Size

    4.2MB

  • MD5

    1d5a0ca464c1573cc629e02efb32a152

  • SHA1

    37d9e651469fe9eb5fcc5fe93a13e87f114b41b7

  • SHA256

    064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784

  • SHA512

    e33af28af79747a3800cca4c9a2208bf011bbd577b4593486faedab939adb8f10478da697b9c7f479c51b6e8db3c6c52606f1055b4decf7aab3dc0807aa22ad8

  • SSDEEP

    98304:Dg2KK3z9OP+9Rqc7b5nBnEQWoYIsaOyk3xd:E2KKjQ+9RZ7RBTYSOyC3

Score
10/10
upxisfbminergoziblackmoonxmrig

Malware Config

Extracted

Family

gozi

Signatures

  • Blackmoon family
    blackmoon
  • Detect Blackmoon payload 1 IoCs
  • Gozi family
    gozi
  • UPX dump on OEP (original entry point) 1 IoCs
  • XMRig Miner payload 1 IoCs
    miner
  • Xmrig family
    xmrig
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 064d2bd707964d68940c8bc7447798dad7b15a6fdc3a2d587d3cd7280418d784
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections