xmrig | Game-s19[.]zip

resource	yara_rule
static1/unpack001/Game-s19/xmrig.exe	xmrig
static1/unpack001/Game-s19/xmrig.exe	family_xmrig

resource
unpack001/Game-s19/xmrig.exe

Game-s19.zip

SHA256 b1aed0f37ea4f5f6331b2324de5a3ed68f8a76e9d0ce1501818c0f4fec51891d
MD5 3f7969a69c3206190ffe4a09968501a1
SHA1 c7ebb762690ba1fac7aacda11a3ee859beb40b83
SHA512 a216ae168a0d1080f6eaa3afe3393ca432cc493096365d573fca18aca6306ae670c0542037dbfa89c1de1873bb39e007d473adb68aa3d23f65939f84c4387e2c
SSDEEP 49152:+C/efKtVdB1jjJy/q+bs4hgh3ElDpXQWNJdi7qLOgth8XlbuJ8cSYS:6KdFy/qtlh3mRpNJddSEcNcSYS
MD5 SHA1 SHA512 SSDEEP

Game-s19/SHA256SUMS

SHA256 3e7be216e75d6038f67e5ce9b87fd5a1bd4968548628b53f42d11c8963dd7cf1
MD5 de6cdb6bb50ef79e724ce9b7cead44a6
SHA1 01d7231a2afe031450401c78d02c782b49056b3d
SHA512 e9fe72308b48680ec6e0581983a5026f124fd13ac50b963e2250626f3f2d59ff5fddd6cf72d0ad9cdef22ac41292f2d185e5b73d9fe6421ffe0a2112b46a23d9
MD5 SHA1 SHA512

Game-s19/WinRing0x64.sys

IMPHASH d41fa95d4642dc981f10de36f4dc8cd7
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

26:68:21:a3:91:74:d2:9f:6f:87:91:cf:9f:44:f1:a1:f3:43:9d:da

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f

Chains

Jul 26, 2008

Subject

CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f

Serial Number

01:00:00:00:00:01:15:37:24:21:a8

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment, KeyUsageDataEncipherment

Timespan

Sep 24, 2007 - Sep 24, 2008

Subject

CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:00:f9:7f:aa:2e:1e

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 16, 2003 - Jan 27, 2014

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:08:d9:61:1c:d6

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 28, 1999 - Jan 27, 2014

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign,1.2.840.113549.1.9.1=#0c1c74696d657374616d70696e666f40676c6f62616c7369676e2e636f6d

Serial Number

04:00:00:00:00:01:10:92:eb:82:95

Issuer

CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 5, 2007 - Jan 27, 2014

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:08:d9:61:24:48

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 22, 2004 - Jan 27, 2014

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:0b:7f:6b:00:00:00:00:00:19

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

0

Major OS version

6

Entry point

20488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb

Name

.text

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

380B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Game-s19/benchmark_10M.cmd

SHA256 235a64e3520b1c2c27763122b303f78aee8d7c083dfd9f1eb936cd5174383609
MD5 5be1c4cacb5ae37c43527e99a097dc7a
SHA1 1b2f00fefde9d601764d5d26d5e0fb2b9f58074c
SHA512 20a9e18bc397fe86514875af4213a02a5831a27671370849f05c2f3ba048bc29fc41ca96f0cb1cc08aaff27bbebf637f30d2ee798cb80ed03080e8c7d8f2d9a1
MD5 SHA1 SHA512

Game-s19/benchmark_1M.cmd

SHA256 d7747e7a3c782009f4ceb6e9c106115876386853929563b509da5258e3968d15
MD5 cba1927cf6959dc99ecbd0c553e4db6f
SHA1 7f2d59cfdf2b0550d22ac54d0b1fa5ac8f8b5f57
SHA512 c78ab9b017153c497ef2d0f568ade265ae9b60238ebdb36d8ef7ecc4d232cd90fd5fdc5b600bb26437466c7300e571b95b4ff92a7f024a981a02196a14d6e3f1
MD5 SHA1 SHA512

Game-s19/config.json

SHA256 f9fa4a4d1c849ecd7d8f35e16851d85bbfbecd7ffff42877f2ee95f627f2bca9
MD5 c506cb52519303c926d0ecb9604885b2
SHA1 eb6e367c356506e6b701bfb4b98ce06a6801a793
SHA512 ac7b8e9c2d55f0d24699cdd1242f525a2a460b4037baca9b646612ded30c1dc800ca86b9b3c931ba8f75336619bbfd9e813180d0e3cce41091d625008f17e0ff
MD5 SHA1 SHA512

Game-s19/pool_mine_example.cmd

SHA256 e73491065d86b1ad69229bb5d2019e08b947e11a2a57adf5c2d9a2b5d8f4acad
MD5 2e737f5c3af9c8aa5216dfdc5be02cc6
SHA1 05fe2040aea6f6cff25deaf5ca2ca6793faa64c7
SHA512 ce0e12a544623458f5905ea20f2b6f0e75cfb57add912290fbf2611eddbe98de7ffed3c9e650747967b2620e5ebbe33e249cbd60e7032bdb10c909cc516709ca
MD5 SHA1 SHA512

Game-s19/rtm_ghostrider_example.cmd

SHA256 810614290bdb14d2ddf10f65f8adc988a8272764f2a9e2c378e52fad162da344
MD5 3f0155abe745be1f6089eafc4f517ac8
SHA1 277f510ceb62b277b141d094c82eedebdc6f3a35
SHA512 8def46852a962ff5dbed94e01f8d23019ef401a718d9c5a440d12b2ffa369539be328f165f68ccc2098cd5e5c939bcb5f784f877bdd7b9d939393bbd2229d19e
MD5 SHA1 SHA512

Game-s19/solo_mine_example.cmd

SHA256 33497c69c21fa96bbc96f1d7f09608e462f8ab22555364977c0bd35fef27bc29
MD5 090703e56f46330ed625ac4363c9d25c
SHA1 6ce0b265e0860f1913f4bb37a17aa7eda88641c5
SHA512 1cd8c43287508c9393300d5a22c565d2f4bd98493a203112fd727518a4e439eb74035d18fe1f52e2d3594305a841ca93fcd0e3c61634f0992cfd3fc253872f19
MD5 SHA1 SHA512

Game-s19/start.cmd

SHA256 8e70ef38fe14a2ee2848df3d6f7e260d1caf8cfc15de694d678b8af151d62333
MD5 eaf3a00cc0465f8af471b849ada29843
SHA1 3042e97874706189aa9704d77c9e74a94e519106
SHA512 56b9f3991ae4bad5e06097d095931e746e6b2ac955649a5c793d9f4f6861c6ffc9316b063c34d7a8079af201354c87bf3008bc0fd4321e59b27e1d8120b078cf
MD5 SHA1 SHA512

Game-s19/xmrig.exe

IMPHASH 12806e48b853545b536463546db4baa1
SHA256 e199d88569fb54346d5fa20ee7b59b2ea6f16f4ecca3ea1e1c937b11aab7b2b0
MD5 c0f8959614ae06561216158d78a787e5
SHA1 73167d1fd0cee1c96a6505606d21cbfe4369eb00
SHA512 a24fcf344d08c64ac301d5e4979f062b5e28e8e4acf1d2790916149ffe7726b0c4a11e0775aeba6b841d2d5081e1bd13e2b80390bf9bfbc44d67e54ec07cd746
SSDEEP 98304:AwHlVzThdquIJ3mH6KfTSr2tJCkN3dOauqMAC2Taf43TZquOE2:fVz5CkN3dXuq9Taf4jLt2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4061668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSASetLastError send recv ntohs htons htonl inet_addr inet_ntoa gethostbyaddr WSAGetLastError WSAIoctl gethostbyname WSARecvFrom WSASocketW WSASend WSARecv gethostname WSADuplicateSocketW getpeername FreeAddrInfoW GetAddrInfoW shutdown socket setsockopt listen connect closesocket bind WSACleanup WSAStartup select getsockopt getsockname ioctlsocket getservbyname getservbyport

iphlpapi

GetAdaptersAddresses

userenv

GetUserProfileDirectoryW

crypt32

CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty CertDuplicateCertificateContext

kernel32

GetStringTypeW InitializeCriticalSectionAndSpinCount WriteConsoleW SetConsoleTitleA GetStdHandle SetConsoleMode GetConsoleMode QueryPerformanceFrequency QueryPerformanceCounter SizeofResource LockResource LoadResource FindResourceW ExpandEnvironmentStringsA GetConsoleWindow GetSystemFirmwareTable HeapFree HeapAlloc GetProcessHeap MultiByteToWideChar SetPriorityClass GetCurrentProcess SetThreadPriority GetSystemPowerStatus GetCurrentThread GetProcAddress GetModuleHandleW GetTickCount CloseHandle FreeConsole VirtualProtect VirtualFree VirtualAlloc GetLargePageMinimum LocalAlloc GetLastError LocalFree FlushInstructionCache GetCurrentThreadId AddVectoredExceptionHandler DeviceIoControl GetModuleFileNameW CreateFileW SetLastError GetSystemTime SystemTimeToFileTime GetModuleHandleExW Sleep InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo SwitchToFiber DeleteFiber CreateFiberEx FindClose FindFirstFileW FindNextFileW WideCharToMultiByte GetSystemDirectoryA FreeLibrary LoadLibraryA FormatMessageA GetFileType WriteFile GetEnvironmentVariableW GetACP ConvertFiberToThread ConvertThreadToFiberEx GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryW ReadConsoleA ReadConsoleW PostQueuedCompletionStatus CreateFileA DuplicateHandle SetEvent ResetEvent WaitForSingleObject CreateEventA QueueUserWorkItem RegisterWaitForSingleObject UnregisterWait GetNumberOfConsoleInputEvents ReadConsoleInputW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW CreateDirectoryW FlushFileBuffers GetDiskFreeSpaceW GetFileAttributesW GetFileInformationByHandle CreateEventW RtlCaptureContext GetFullPathNameW ReadFile RemoveDirectoryW SetFilePointerEx SetFileTime MapViewOfFile FlushViewOfFile UnmapViewOfFile CreateFileMappingA ReOpenFile CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS ReleaseSemaphore ResumeThread GetNativeSystemInfo GetProcessAffinityMask SetThreadAffinityMask CreateSemaphoreA SetConsoleCtrlHandler GetCurrentDirectoryW GetLongPathNameW RtlUnwind CreateIoCompletionPort ReadDirectoryChangesW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetCurrentDirectoryW GetTempPathW GlobalMemoryStatusEx FileTimeToSystemTime K32GetProcessMemoryInfo SetHandleInformation CancelIoEx CancelIo SwitchToThread SetFileCompletionNotificationModes LoadLibraryExW SetErrorMode GetQueuedCompletionStatus ConnectNamedPipe SetNamedPipeHandleState PeekNamedPipe CreateNamedPipeW CancelSynchronousIo GetNamedPipeHandleStateA GetNamedPipeClientProcessId GetNamedPipeServerProcessId TerminateProcess GetExitCodeProcess UnregisterWaitEx LCMapStringW DebugBreak GetModuleHandleA LoadLibraryExA GetStartupInfoW GetModuleFileNameA GetVersionExA SetProcessAffinityMask GetComputerNameA FlsFree FlsSetValue FlsGetValue FlsAlloc GetCPInfo RtlLookupFunctionEntry GetFinalPathNameByHandleW RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetStdHandle GetCommandLineA GetCommandLineW CreateThread ExitThread FreeLibraryAndExitThread GetDriveTypeW SystemTimeToTzSpecificLocalTime ExitProcess GetFileAttributesExW SetFileAttributesW GetConsoleOutputCP CompareStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetTimeZoneInformation HeapSize SetEndOfFile FindFirstFileExW IsValidCodePage GetOEMCP GetFileSizeEx GetShortPathNameW CompareStringEx LCMapStringEx InitializeCriticalSectionEx WaitForSingleObjectEx GetExitCodeThread SleepConditionVariableSRW EncodePointer DecodePointer

user32

GetLastInputInfo MessageBoxW GetProcessWindowStation TranslateMessage GetUserObjectInformationW ShowWindow DispatchMessageA GetSystemMetrics MapVirtualKeyW GetMessageA

shell32

SHGetSpecialFolderPathA

ole32

CoInitializeEx CoUninitialize CoCreateInstance

advapi32

SystemFunction036 GetUserNameW ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW QueryServiceConfigA DeleteService ControlService StartServiceW OpenServiceW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken LsaOpenPolicy LsaAddAccountRights LsaClose GetTokenInformation

bcrypt

BCryptGenRandom

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

64KB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

169KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Game-s19.zip

Game-s19/SHA256SUMS

Game-s19/WinRing0x64.sys

PE Signature issue

ntoskrnl.exe

hal

generic

Game-s19/benchmark_10M.cmd

Game-s19/benchmark_1M.cmd

Game-s19/config.json

Game-s19/pool_mine_example.cmd

Game-s19/rtm_ghostrider_example.cmd

Game-s19/solo_mine_example.cmd

Game-s19/start.cmd

Game-s19/xmrig.exe

ws2_32

iphlpapi

userenv

crypt32

kernel32

user32

shell32

ole32

advapi32

bcrypt

generic

Sharing

General

Malware Config

Signatures

File Explorer

Game-s19.zip

Game-s19/SHA256SUMS

Game-s19/WinRing0x64.sys

PE Signature issue

ntoskrnl.exe

hal

generic

Game-s19/benchmark_10M.cmd

Game-s19/benchmark_1M.cmd

Game-s19/config.json

Game-s19/pool_mine_example.cmd

Game-s19/rtm_ghostrider_example.cmd

Game-s19/solo_mine_example.cmd

Game-s19/start.cmd

Game-s19/xmrig.exe

ws2_32

iphlpapi

userenv

crypt32

kernel32

user32

shell32

ole32

advapi32

bcrypt

generic