xmrig

General

Target
Viral RAT 1.0 by Sameed.zip
Size 5.3MB
Sample240618-v4fpdaxdql
SHA256 66cf95fbd7e5d2adb54c7be2a49210ac98003bcaef668271a8692865389b840a
MD5 43043994e295ef352625a61364ef5ae3
SHA1 5a4ce6d1c081f53c4a2eb9ccb169bdbabd79324b
SHA512 e362399bbbad59fc26a6a3a7b6ce2c67a060f9739e91121943d1d604ea9e4e43bfd4ff3989cd427e23fcb122647ae4b299286ca745cb456fabe3d3ea319a66d5
SSDEEP 98304:9Mp7nfNmyMEQsUrZCejbLC1sJnz5MLOE7B5bxbBcG1MxZ0Mewg7LTuABAPW1:Kp7YdE/UrweXLJJl/E151br18ZFaHhBx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Viral RAT 1.0 by Sameed/Stub.exe
- Size 502KB
- SHA256 e693e05888147223f78c57a5d2a0bccc594af7e6f0d9c5d6bd8a0cb5d420a851
- MD5 411062115f006fef08db4e7a8b35a08a
- SHA1 c63c97aa1dbed7b62640698893b296339125d40f
- SHA512 1bc8b85cd23cf55f3f5272db32b27af32499809f495144622a803c4312ba10433eb1653b9748c3b9cfe06e533aeb2a03052f0a2b0871e1ab623e654ed1a2137f
- SSDEEP 6144:mRrXVpyQ5L9hYNuy1TEMzvwvzKe4P6gOrS9cav70BcM9HT+O0p5yl+aJI+bHgbDa:mrnF5j4TEm0g5psl+amz3AXSY/A
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Viral RAT 1.0 by Sameed/Viral - Rat By Sameedx.exe
- Size 5.5MB
- SHA256 7bbc65ed68543a966e7b166f1e17efb4c1bea40a1d441b03c93f2c225a4c50b6
- MD5 0d8a326d2676741da4e4506b0dc0614f
- SHA1 cfdf089f3201d44b78248936a77c82dc1122a1ab
- SHA512 debeeefdfe9e015b2bac1286bc959490ce0bee1da634f02aa61dab4f4cb2fb8abde69a1dc1680267f2f2e29c1d95afd0625b646b19945f573aa81ec59469a39f
- SSDEEP 98304:fJnZwQl/VAQRxdsPKJ/lRM/oO3FX5Tz1m2HK1T2oAcEFZNOwBChw:fJWQl/GQDd3JjPOVXRzPHGTbarxBP
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xmrig evasion miner persistence privilege_escalation spyware stealer
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral3 behavioral4