General

  • Target

    52a10eddaaea5bdd91aa990ce776059464846683300b83e1450012afae7372a8

  • Size

    1KB

  • Sample

    240724-ns6yvsvamm

  • MD5

    5cb7d4ba7ddc5ed6d5ea50e08fb5e12f

  • SHA1

    349702173d273414e1e44a511aad63dced16773b

  • SHA256

    52a10eddaaea5bdd91aa990ce776059464846683300b83e1450012afae7372a8

  • SHA512

    33b7132c18b87519b52c86d4a58c028e62deab2fd604d4411cd16aab120dc0e2bdc478fb04c97f4196f2604c96d8826bf749344e85cf2cb0f0693b1c548e4097

Malware Config

Targets

    • Target

      52a10eddaaea5bdd91aa990ce776059464846683300b83e1450012afae7372a8

    • Size

      1KB

    • MD5

      5cb7d4ba7ddc5ed6d5ea50e08fb5e12f

    • SHA1

      349702173d273414e1e44a511aad63dced16773b

    • SHA256

      52a10eddaaea5bdd91aa990ce776059464846683300b83e1450012afae7372a8

    • SHA512

      33b7132c18b87519b52c86d4a58c028e62deab2fd604d4411cd16aab120dc0e2bdc478fb04c97f4196f2604c96d8826bf749344e85cf2cb0f0693b1c548e4097

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Contacts a large (859022) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • XMRig Miner payload

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Attempts to change immutable files

      Modifies inode attributes on the filesystem to allow changing of immutable files.

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads hardware information

      Accesses system info like serial numbers, manufacturer names etc.

    • Reads network interface configuration

      Fetches information about one or more active network interfaces.

MITRE ATT&CK Enterprise v15

Tasks