Behavioral task
behavioral1
Sample
aa0100db048efd655e9c72f08108b966972e8e3966527a7cd2614bbde336eeb0.exe
Behavioral task
behavioral2
Sample
aa0100db048efd655e9c72f08108b966972e8e3966527a7cd2614bbde336eeb0.exe
General
-
Target
aa0100db048efd655e9c72f08108b966972e8e3966527a7cd2614bbde336eeb0
-
Size
1.7MB
-
MD5
3a7641bfcda347bbab6a239fa579a72e
-
SHA1
569ee2b1a2220906ec34cc84cf9b0b8fcea38344
-
SHA256
aa0100db048efd655e9c72f08108b966972e8e3966527a7cd2614bbde336eeb0
-
SHA512
f3da4361f578a84fb8ccfad6dc83cc7bf78b8481bde6b33b2f56e57b7cc57b2b059491abfd029a211b0b55beab29ba0d9e1cac1dc59e4c69a43f0efe52032fd3
-
SSDEEP
49152:BezaTF8FcNkNdfE0pZ9ozt4wI8Y2oPYmH:BemTLkNdfE0pZrL
Malware Config
Signatures
-
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa0100db048efd655e9c72f08108b966972e8e3966527a7cd2614bbde336eeb0
Files
-
aa0100db048efd655e9c72f08108b966972e8e3966527a7cd2614bbde336eeb0.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 724KB - Virtual size: 3.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 272KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE