General

  • Target

    42e165b26ca02e57f5e5ff2dc0631950N.exe

  • Size

    3.1MB

  • Sample

    240707-fpkbpavakl

  • MD5

    42e165b26ca02e57f5e5ff2dc0631950

  • SHA1

    31008fe3fb2a0dff79584e839f7ca1bd453b2260

  • SHA256

    645c7ecce962391601d470eabb8b0a0c204a7d7ef71fe247c146d26c052ab881

  • SHA512

    fadb0a52da5d31628ad06c6fd47901090bb9ead9e6770590267cf518c9e9ee16c4242809b5d4b1cd1f434b352ad69bdb79a66c98c2552de25f850f0609fbb22f

  • SSDEEP

    98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW/:7bBeSFkr

Malware Config

Targets

    • Target

      42e165b26ca02e57f5e5ff2dc0631950N.exe

    • Size

      3.1MB

    • MD5

      42e165b26ca02e57f5e5ff2dc0631950

    • SHA1

      31008fe3fb2a0dff79584e839f7ca1bd453b2260

    • SHA256

      645c7ecce962391601d470eabb8b0a0c204a7d7ef71fe247c146d26c052ab881

    • SHA512

      fadb0a52da5d31628ad06c6fd47901090bb9ead9e6770590267cf518c9e9ee16c4242809b5d4b1cd1f434b352ad69bdb79a66c98c2552de25f850f0609fbb22f

    • SSDEEP

      98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW/:7bBeSFkr

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks