Behavioral task
behavioral1
Sample
9a173ff88f6fd9e086031de384865370857237fb65d73d450959a780f672d8a9.exe
Resource
win7-20231129-en
General
-
Target
9a173ff88f6fd9e086031de384865370857237fb65d73d450959a780f672d8a9
-
Size
3.0MB
-
MD5
1a7fc447a9d434fb5a435b886aa4c003
-
SHA1
1a204ddc9f24509a9800f0cabfa51edf04ab2ded
-
SHA256
9a173ff88f6fd9e086031de384865370857237fb65d73d450959a780f672d8a9
-
SHA512
4e4e223f6ae523a2474839e53a124ed6aa534cc2fba2876fe58ecb5c4c1d3a95adc3cfdd6cdacc5ae38d2cd32516475f383faa9b02c12768de946a0c7d1dfcb4
-
SSDEEP
49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsOass:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
Malware Config
Signatures
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9a173ff88f6fd9e086031de384865370857237fb65d73d450959a780f672d8a9
Files
-
9a173ff88f6fd9e086031de384865370857237fb65d73d450959a780f672d8a9.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 1.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 525KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE