Overview

overview

10

Static

static

10

02f805d45d...18.exe

windows7-x64

10

02f805d45d...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    02f805d45dac49e4d7d9fcde01de966d_JaffaCakes118

  • Size

    2.3MB

  • Sample

    240727-3zjjgayfmb

  • MD5

    02f805d45dac49e4d7d9fcde01de966d

  • SHA1

    5d108de4308559df72cdf59fdf26b93ef689efbc

  • SHA256

    586a3c8f824592ddeb93c45d0d8f6c316bba1966c6773562b9d7dd60d7d71bef

  • SHA512

    770d3d1bf36911331ebff2ad965be7e44637455b282e6319c14a5f3895e9acb6c13bde21c51f54c072300c28b495227993e2e5e5e88e87f83e39322c788a336f

  • SSDEEP

    49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//w:NABI

Score
10/10
xmrigexecutionminerpersistenceprivilege_escalationupx

Malware Config

Targets

    • Target

      02f805d45dac49e4d7d9fcde01de966d_JaffaCakes118

    • Size

      2.3MB

    • MD5

      02f805d45dac49e4d7d9fcde01de966d

    • SHA1

      5d108de4308559df72cdf59fdf26b93ef689efbc

    • SHA256

      586a3c8f824592ddeb93c45d0d8f6c316bba1966c6773562b9d7dd60d7d71bef

    • SHA512

      770d3d1bf36911331ebff2ad965be7e44637455b282e6319c14a5f3895e9acb6c13bde21c51f54c072300c28b495227993e2e5e5e88e87f83e39322c788a336f

    • SSDEEP

      49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//w:NABI

    Score
    10/10
    xmrigexecutionminerupxpersistenceprivilege_escalation

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks