General

  • Target

    293d0ab228cb8095cd6384513552403ffbbf24115dca23ec731b579d812b3dba

  • Size

    4.3MB

  • Sample

    240614-ympshatcpg

  • MD5

    1a8ad0e310fdfef2b79b4a79439791c3

  • SHA1

    f6910a1a55aad60effac38c4cb43df9ddedde719

  • SHA256

    293d0ab228cb8095cd6384513552403ffbbf24115dca23ec731b579d812b3dba

  • SHA512

    42341fcf83c061b786e73f7254828691067d54bcee1cee893499faa732cf54192af85c24c88ad0241801afed1a1cba15572aafa857276e5a4010eedb4553799f

  • SSDEEP

    98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWv:7bBeSFkj

Malware Config

Targets

    • Target

      293d0ab228cb8095cd6384513552403ffbbf24115dca23ec731b579d812b3dba

    • Size

      4.3MB

    • MD5

      1a8ad0e310fdfef2b79b4a79439791c3

    • SHA1

      f6910a1a55aad60effac38c4cb43df9ddedde719

    • SHA256

      293d0ab228cb8095cd6384513552403ffbbf24115dca23ec731b579d812b3dba

    • SHA512

      42341fcf83c061b786e73f7254828691067d54bcee1cee893499faa732cf54192af85c24c88ad0241801afed1a1cba15572aafa857276e5a4010eedb4553799f

    • SSDEEP

      98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWv:7bBeSFkj

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Detects executables containing URLs to raw contents of a Github gist

    • UPX dump on OEP (original entry point)

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks