xmrig | Silent[.]Crypto[.]Miner[.]Builder[.]rar

General

Target
Silent.Crypto.Miner.Builder.rar
Size 81.8MB
Sample240717-a6sfqs1dpc
SHA256 2d892e65432b58585112e78deec5750652a25249dd4f56e0fd6d47fe7804baf1
MD5 933d0f5124ce80145887ac1fa70cce22
SHA1 0d18410b44a306620faa6e80ab2a1f3b454638e8
SHA512 62ce1274e2ff0cf808d291ed8db92c17bcd1b1eb5caac4573a7c9cda1b88fa85958711f3f4a6f3df3092184a049dca0bd7a7d58f536e8772fddfd934ccdb99b6
SSDEEP 1572864:Fd61wTAxnsyiOtrAqunqBZqx6ikncQTw5EH+tjkx6SR0thS3eb7Dt:FFTUnsHOhTPU6iknFOk+tjkx6RthOeXB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

miner xmrig

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
static1/unpack001/Repo/bin/unam.exe	xmrig
static1/unpack001/Repo/bin/unam.exe	family_xmrig

Xmrig family
xmrig

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Repo/bin/unam.exe
unpack001/Silent Crypto Miner Builder.exe

File Explorer

Silent.Crypto.Miner.Builder.rar

.rar 81.8MB
Repo/bin/dll.bat

.bat .vbs 382KB
Repo/bin/unam.exe

.exe 129.3MB
Silent Crypto Miner Builder.exe

.exe 139KB

Silent.Crypto.Miner.Builder.rar

SHA256 2d892e65432b58585112e78deec5750652a25249dd4f56e0fd6d47fe7804baf1
MD5 933d0f5124ce80145887ac1fa70cce22
SHA1 0d18410b44a306620faa6e80ab2a1f3b454638e8
SHA512 62ce1274e2ff0cf808d291ed8db92c17bcd1b1eb5caac4573a7c9cda1b88fa85958711f3f4a6f3df3092184a049dca0bd7a7d58f536e8772fddfd934ccdb99b6
SSDEEP 1572864:Fd61wTAxnsyiOtrAqunqBZqx6ikncQTw5EH+tjkx6SR0thS3eb7Dt:FFTUnsHOhTPU6iknFOk+tjkx6RthOeXB
MD5 SHA1 SHA512 SSDEEP

Repo/bin/unam.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 17c277605769ede5442963fa5cad409a03c23077c34f9ed6a1f72835154294d3
MD5 9b9dbfc1da565ff50d7869c68d12178d
SHA1 e8c7e312d9848f95f17d72f45403ce0159777444
SHA512 66491d4084594d0e4bbea3ac0224c691f43a023a45313056138d8494aeb80062ffba5f9c213fdc3b1b0ed07f38806d10bd3a39c80b872e45aaa824be7fb72751
SSDEEP 3145728:bajeamjoC0MCr7jkS4aJwVlwV7iGYQ07SLjl:baaamEC0MQkiv7i92
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

135440430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\CRYPTOCOIN\Mining\Miner\SilentCryptoMiner\SilentCryptoMiner\obj\Release\Silent Crypto Miner Builder.pdb

Silent Crypto Miner Builder.exe

SHA256 d833831e38738d03ed6156ec458d3252c379cf7c9c986fcfe8626184d3bceafd
MD5 29d9c4a6c0be4ebb665ca5f423da7bdb
SHA1 d22b7b928436ba4f9d7a3a40a6db20a227b57c2a
SHA512 114e82df03e624ef350a5c71bd05594f9075afce7a2d978ede81a9cc086a9d87fec7884b5f5e7e1b52b8a24741fdaf453033b486b87d79cc599af37162870d0d
SSDEEP 3072:+zIJ3v9gOYQTTwVGKCXH6ZKjjJHYFc778K3o:zJ3vtYQTT6GKCuOr3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Torenta\Desktop\offlinee\Light-The-Dark-1.0.1\obj\Debug\Silent Crypto Miner Builder.pdb

Silent.Crypto.Miner.Builder.rar

Repo/bin/dll.bat

Repo/bin/unam.exe

mscoree

dotnet

Silent Crypto Miner Builder.exe

generic

Sharing

General

Malware Config

Signatures

File Explorer

Silent.Crypto.Miner.Builder.rar

Repo/bin/dll.bat

Repo/bin/unam.exe

mscoree

dotnet

Silent Crypto Miner Builder.exe

generic