General

  • Target

    a7b8d88f7a89dbb5321592e95aed251f16594ce1089dc3405bb6ec03bf1ea1f6

  • Size

    3.0MB

  • Sample

    240610-s5x9ps1hqa

  • MD5

    5b6c593cc8c8b8065ec7e5b8f26a6723

  • SHA1

    fb60abd935a47af5c97b2f345132131f66685b5b

  • SHA256

    a7b8d88f7a89dbb5321592e95aed251f16594ce1089dc3405bb6ec03bf1ea1f6

  • SHA512

    00b575200a47ab4f140bcf736120f2ada61eabcc5ee53faa62bc1343ae4723b53a2da77db1f0386046a0b509ebd2aae01cabd8f42d0b6d8268b1d78eba8e85e0

  • SSDEEP

    98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWo:7bBeSFkM

Malware Config

Targets

    • Target

      a7b8d88f7a89dbb5321592e95aed251f16594ce1089dc3405bb6ec03bf1ea1f6

    • Size

      3.0MB

    • MD5

      5b6c593cc8c8b8065ec7e5b8f26a6723

    • SHA1

      fb60abd935a47af5c97b2f345132131f66685b5b

    • SHA256

      a7b8d88f7a89dbb5321592e95aed251f16594ce1089dc3405bb6ec03bf1ea1f6

    • SHA512

      00b575200a47ab4f140bcf736120f2ada61eabcc5ee53faa62bc1343ae4723b53a2da77db1f0386046a0b509ebd2aae01cabd8f42d0b6d8268b1d78eba8e85e0

    • SSDEEP

      98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWo:7bBeSFkM

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Detects executables containing URLs to raw contents of a Github gist

    • UPX dump on OEP (original entry point)

    • XMRig Miner payload

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks