xmrig | 5688020a00a328c20df4b4008a5a32ec9c6fa567be80f146614c2b34028a3f1a[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

5688020a00a328c20df4b4008a5a32ec9c6fa567be80f146614c2b34028a3f1a.exe
Size

7.1MB
MD5

6dfb2320569aa3a2cb41722217715f06
SHA1

c87e51dcd2ec66569fe12d0f55fac926de5d84eb
SHA256

5688020a00a328c20df4b4008a5a32ec9c6fa567be80f146614c2b34028a3f1a
SHA512

3a4d75ea74e35f7d45b2415cc1b541c216b3bdb3b8342dbd57e0aa4177c66c6c7f845f96ef56caaca5ee329b8fce4f94462eaaa4d46431634e1287e158f973ae
SSDEEP

98304:k+3Y0aD5M1j9UUIwiCFY8ModeLaR995E5rqNkSiPYrHktYQmSoBHGEWmTJsJ1CB:k7JGHUZYrHkiQmnGEWoqsB

Score

10^/10

miner xmrig

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
sample	xmrig
sample	family_xmrig

Xmrig family
xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5688020a00a328c20df4b4008a5a32ec9c6fa567be80f146614c2b34028a3f1a.exe

Files

5688020a00a328c20df4b4008a5a32ec9c6fa567be80f146614c2b34028a3f1a.exe
.exe windows:6 windows x64 arch:x64

4a6caf412fd81bf0f5a45b3e56865c49

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

uv

uv_cond_init
uv_cond_signal
uv_mutex_lock
uv_cond_wait
uv_mutex_destroy
uv_cond_destroy
uv_mutex_unlock
uv_mutex_init
uv_is_closing
uv_resident_set_memory
uv_interface_addresses
uv_free_interface_addresses
uv_loadavg
uv_accept
uv_get_total_memory
uv_get_free_memory
uv_loop_init
uv_thread_join
uv_thread_create
uv_run
uv_loop_close
uv_dlclose
uv_dlerror
uv_dlopen
uv_dlsym
uv_queue_work
uv_tcp_getsockname
uv_listen
uv_tcp_bind
uv_write
uv_tcp_getpeername
uv_timer_start
uv_timer_set_repeat
uv_timer_stop
uv_timer_init
uv_setup_args
uv_ip6_addr
uv_ip4_addr
uv_tcp_nodelay
uv_tcp_keepalive
uv_tcp_init
uv_tcp_connect
uv_strerror
uv_freeaddrinfo
uv_getaddrinfo
uv_ip6_name
uv_ip4_name
uv_exepath
uv_cwd
uv_chdir
uv_os_homedir
uv_os_tmpdir
uv_version_string
uv_fs_event_start
uv_fs_event_stop
uv_fs_event_init
uv_signal_init
uv_signal_stop
uv_signal_start
uv_fs_req_cleanup
uv_fs_write
uv_fs_stat
uv_fs_open
uv_try_write
uv_buf_init
uv_is_writable
uv_tty_init
uv_read_start
uv_guess_handle
uv_is_readable
uv_tty_set_mode
uv_tty_reset_mode
uv_default_loop
uv_async_init
uv_async_send
uv_close

ws2_32

ntohs
htons
setsockopt
recv
send
shutdown
socket
WSASetLastError
WSAGetLastError
htonl
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
gethostname
connect
closesocket
WSACleanup
WSAStartup
select
getsockopt
ioctlsocket

crypt32

CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CertGetCertificateContextProperty

kernel32

FreeLibraryAndExitThread
ExitThread
CreateThread
GetCommandLineW
GetCommandLineA
SetStdHandle
LoadLibraryExW
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
GetDriveTypeW
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
GetNativeSystemInfo
GetExitCodeThread
WaitForSingleObjectEx
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandle
SetFilePointerEx
FlsAlloc
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
ExitProcess
SetConsoleCtrlHandler
GetFileSizeEx
WriteConsoleW
SetConsoleTitleA
GetStdHandle
FlsGetValue
GetConsoleMode
QueryPerformanceFrequency
QueryPerformanceCounter
SizeofResource
LockResource
LoadResource
FindResourceW
ExpandEnvironmentStringsA
GetConsoleWindow
GetSystemFirmwareTable
HeapFree
HeapAlloc
GetProcessHeap
MultiByteToWideChar
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetSystemPowerStatus
GetCurrentThread
GetProcAddress
GetModuleHandleW
GetTickCount
CloseHandle
FreeConsole
VirtualProtect
VirtualFree
VirtualAlloc
GetLargePageMinimum
LocalAlloc
GetLastError
LocalFree
FlushInstructionCache
GetCurrentThreadId
AddVectoredExceptionHandler
DeviceIoControl
GetModuleFileNameW
CreateFileW
SetLastError
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemInfo
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
GetSystemDirectoryA
FreeLibrary
RtlUnwind
FormatMessageA
GetEnvironmentVariableW
GetFileType
WriteFile
GetACP
ConvertFiberToThread
ConvertThreadToFiber
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlVirtualUnwind
LoadLibraryW
ReadConsoleA
ReadConsoleW
SwitchToThread
GetModuleFileNameA
GetVersionExA
GetModuleHandleA
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
GetComputerNameA
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleOutputCP
HeapReAlloc
FlushFileBuffers
GetTimeZoneInformation
CreateDirectoryW
HeapSize
GetCurrentDirectoryW
GetFullPathNameW
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetConsoleMode
LoadLibraryA

user32

ShowWindow
GetLastInputInfo
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation

shell32

SHGetSpecialFolderPathA

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

advapi32

CryptAcquireContextW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
QueryServiceConfigA
DeleteService
ControlService
StartServiceW
OpenServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
DeregisterEventSource
RegisterEventSourceW
CreateServiceW
ReportEventW
CryptGenRandom

Sections

.text
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RANDOMX
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_TEXT_CN
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_TEXT_CN
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a6caf412fd81bf0f5a45b3e56865c49

Headers

DLL Characteristics

File Characteristics

Imports

uv

ws2_32

crypt32

kernel32

user32

shell32

ole32

advapi32

Sections

.text Size: 5.2MB - Virtual size: 5.2MB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.data Size: 70KB - Virtual size: 157KB

.pdata Size: 167KB - Virtual size: 166KB

_RANDOMX Size: 3KB - Virtual size: 3KB

_TEXT_CN Size: 10KB - Virtual size: 9KB

_TEXT_CN Size: 4KB - Virtual size: 4KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 46KB - Virtual size: 45KB

.text
Size: 5.2MB - Virtual size: 5.2MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 70KB - Virtual size: 157KB

.pdata
Size: 167KB - Virtual size: 166KB

_RANDOMX
Size: 3KB - Virtual size: 3KB

_TEXT_CN
Size: 10KB - Virtual size: 9KB

_TEXT_CN
Size: 4KB - Virtual size: 4KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 46KB - Virtual size: 45KB