Overview

overview

10

Static

static

1

1514247562536.bat

windows7-x64

10

1514247562536.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1514247562536.bat

  • Size

    524B

  • Sample

    240701-ybxzqswajd

  • MD5

    92b307667679cc4bca93a2417be6137b

  • SHA1

    5347620d753e52dbd274d04ae87356e09fe1c16d

  • SHA256

    9646675a0d5cb5ccf4aa9408fc698bf5d020d27015c69c9c1ab0e2290137fdd5

  • SHA512

    d99751550c337010791b8522ce1966384b41b2f17d6bfaf89034ce9ef25e2648e99ce5b345c6858c79b7af65b357036b42ed88447bca5854644d12ce9cf8a791

Score
10/10
evasionexecution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.254.97.190:2024/test.txt

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://github.com/xmrig/xmrig/releases/latest

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.comDownloadString

Targets

    • Target

      1514247562536.bat

    • Size

      524B

    • MD5

      92b307667679cc4bca93a2417be6137b

    • SHA1

      5347620d753e52dbd274d04ae87356e09fe1c16d

    • SHA256

      9646675a0d5cb5ccf4aa9408fc698bf5d020d27015c69c9c1ab0e2290137fdd5

    • SHA512

      d99751550c337010791b8522ce1966384b41b2f17d6bfaf89034ce9ef25e2648e99ce5b345c6858c79b7af65b357036b42ed88447bca5854644d12ce9cf8a791

    Score
    10/10
    evasionexecution

    • Blocklisted process makes network request

    • Stops running service(s)

      evasionexecution

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks