Behavioral task
behavioral1
Sample
c63c6b4f58dcccb48e07f3e27b17d80ae8b2b2bd751707d415086ad67eea0336.exe
Resource
win7-20240508-en
General
-
Target
c63c6b4f58dcccb48e07f3e27b17d80ae8b2b2bd751707d415086ad67eea0336
-
Size
2.3MB
-
MD5
493d3feb1d7e062bdfaa82018568cad2
-
SHA1
e12f0723b56d8de36e3802d7ebb8b81a4b085822
-
SHA256
c63c6b4f58dcccb48e07f3e27b17d80ae8b2b2bd751707d415086ad67eea0336
-
SHA512
a76608e4e94056f4d44bb5d140c58ea881038bec7e9d26ce8339ec3f9bf8a18cf9221b7de0d98e8b52d29b98c30b9efa6274b0f3162bb88f0ae4c9b9f47b05b2
-
SSDEEP
49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+AKwOowx8QdKS43:BemTLkNdfE0pZr+
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c63c6b4f58dcccb48e07f3e27b17d80ae8b2b2bd751707d415086ad67eea0336
Files
-
c63c6b4f58dcccb48e07f3e27b17d80ae8b2b2bd751707d415086ad67eea0336.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 724KB - Virtual size: 3.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 272KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE