Behavioral task
behavioral1
Sample
ba1490538d536fb4564fe4a6250aa6d2f75209f7b6e2ef6d3cec14f1f314f230.exe
Resource
win7-20240419-en
General
-
Target
ba1490538d536fb4564fe4a6250aa6d2f75209f7b6e2ef6d3cec14f1f314f230
-
Size
1.8MB
-
MD5
1ca276df5d9f9b5f2e5094fd1f873b9d
-
SHA1
c1da2cbc4a0a9a72088d98aa85a575dfd0a17dfc
-
SHA256
ba1490538d536fb4564fe4a6250aa6d2f75209f7b6e2ef6d3cec14f1f314f230
-
SHA512
b7bb70011221d8a45fe092fdeeec98cb3f0bedbb7a50738d9d3ec2634ea776f7827f6203990139ff03687b65bb979d0ed449d0e5fdb9581114e9ba200267e08c
-
SSDEEP
49152:oezaTF8FcNkNdfE0pZ9ozt4wICbbnlD5E9p:oemTLkNdfE0pZrx
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba1490538d536fb4564fe4a6250aa6d2f75209f7b6e2ef6d3cec14f1f314f230
Files
-
ba1490538d536fb4564fe4a6250aa6d2f75209f7b6e2ef6d3cec14f1f314f230.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 724KB - Virtual size: 3.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 272KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE