Overview

overview

10

Static

static

3

Killer.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Killer.exe

  • Size

    30.1MB

  • Sample

    240726-rtlwvstcmn

  • MD5

    3d8a1274c158597b5f19a3a5e3585359

  • SHA1

    2e230262da6e67c3453f3a27d71f85368db28797

  • SHA256

    86b81bf7f83767c4934acaacdc5969d71c3ba8d897447993a4a6ebaaf23dfb6b

  • SHA512

    76031a816caa45a30d4cc14299b4d5b61a63f829212239db53e616e93503da62589c1fc4c62e16dec7e9d9ef4b7fb997ada6ea3d471585a5ee6ec57ad0ef9f29

  • SSDEEP

    786432:bCG6YUg4E4NakUtnEfz7vr85ienl0Zsgf68S1eQ/7:GG6YU1E4NNY5grS1eQ/7

Score
10/10
privateloaderxmrigdefense_evasiondiscoveryloaderminerupxvmprotect

Malware Config

Targets

    • Target

      Killer.exe

    • Size

      30.1MB

    • MD5

      3d8a1274c158597b5f19a3a5e3585359

    • SHA1

      2e230262da6e67c3453f3a27d71f85368db28797

    • SHA256

      86b81bf7f83767c4934acaacdc5969d71c3ba8d897447993a4a6ebaaf23dfb6b

    • SHA512

      76031a816caa45a30d4cc14299b4d5b61a63f829212239db53e616e93503da62589c1fc4c62e16dec7e9d9ef4b7fb997ada6ea3d471585a5ee6ec57ad0ef9f29

    • SSDEEP

      786432:bCG6YUg4E4NakUtnEfz7vr85ienl0Zsgf68S1eQ/7:GG6YU1E4NNY5grS1eQ/7

    Score
    10/10
    privateloaderxmrigdefense_evasiondiscoveryloaderminerupxvmprotect

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies file permissions

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks