xmrig | Game-s2[.]zip

resource	yara_rule
static1/unpack001/Game-s2/xmrig.exe	xmrig
static1/unpack001/Game-s2/xmrig.exe	family_xmrig

resource
unpack001/Game-s2/xmrig.exe

Game-s2.zip

SHA256 894a05a1a73f2d70984c0776a66235030279454ab44a25279d894bfcb4cfc425
MD5 7b58f53a78466d6ac5b876f9f80ca304
SHA1 5a4224b4e21ed76d8b86b835cf72851e69ff90e0
SHA512 a49180dbc1d6098f1d97ac0b6361a3e7d64b1157e086dcd5c302070f65e08cc147e96ed66402e5ac8a80d752b29b9a4b2d007d40ae95aba6f9258418b3d86dc0
SSDEEP 49152:aC/efKtVdB1jjJy/q+bs4hgh3ElDpXQWNJdi7qLOgth8XlbuJ8cSYp:WKdFy/qtlh3mRpNJddSEcNcSYp
MD5 SHA1 SHA512 SSDEEP

Game-s2/SHA256SUMS

SHA256 3e7be216e75d6038f67e5ce9b87fd5a1bd4968548628b53f42d11c8963dd7cf1
MD5 de6cdb6bb50ef79e724ce9b7cead44a6
SHA1 01d7231a2afe031450401c78d02c782b49056b3d
SHA512 e9fe72308b48680ec6e0581983a5026f124fd13ac50b963e2250626f3f2d59ff5fddd6cf72d0ad9cdef22ac41292f2d185e5b73d9fe6421ffe0a2112b46a23d9
MD5 SHA1 SHA512

Game-s2/WinRing0x64.sys

IMPHASH d41fa95d4642dc981f10de36f4dc8cd7
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

26:68:21:a3:91:74:d2:9f:6f:87:91:cf:9f:44:f1:a1:f3:43:9d:da

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f

Chains

Jul 26, 2008

Subject

CN=Noriyuki MIYAZAKI,C=JP,1.2.840.113549.1.9.1=#0c196869796f6869796f406372797374616c6d61726b2e696e666f

Serial Number

01:00:00:00:00:01:15:37:24:21:a8

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment, KeyUsageDataEncipherment

Timespan

Sep 24, 2007 - Sep 24, 2008

Subject

CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:00:f9:7f:aa:2e:1e

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 16, 2003 - Jan 27, 2014

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:08:d9:61:1c:d6

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 28, 1999 - Jan 27, 2014

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign,1.2.840.113549.1.9.1=#0c1c74696d657374616d70696e666f40676c6f62616c7369676e2e636f6d

Serial Number

04:00:00:00:00:01:10:92:eb:82:95

Issuer

CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 5, 2007 - Jan 27, 2014

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:08:d9:61:24:48

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 22, 2004 - Jan 27, 2014

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:0b:7f:6b:00:00:00:00:00:19

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

0

Major OS version

6

Entry point

20488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb

Name

.text

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

380B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Game-s2/benchmark_10M.cmd

SHA256 235a64e3520b1c2c27763122b303f78aee8d7c083dfd9f1eb936cd5174383609
MD5 5be1c4cacb5ae37c43527e99a097dc7a
SHA1 1b2f00fefde9d601764d5d26d5e0fb2b9f58074c
SHA512 20a9e18bc397fe86514875af4213a02a5831a27671370849f05c2f3ba048bc29fc41ca96f0cb1cc08aaff27bbebf637f30d2ee798cb80ed03080e8c7d8f2d9a1
MD5 SHA1 SHA512

Game-s2/benchmark_1M.cmd

SHA256 d7747e7a3c782009f4ceb6e9c106115876386853929563b509da5258e3968d15
MD5 cba1927cf6959dc99ecbd0c553e4db6f
SHA1 7f2d59cfdf2b0550d22ac54d0b1fa5ac8f8b5f57
SHA512 c78ab9b017153c497ef2d0f568ade265ae9b60238ebdb36d8ef7ecc4d232cd90fd5fdc5b600bb26437466c7300e571b95b4ff92a7f024a981a02196a14d6e3f1
MD5 SHA1 SHA512

Game-s2/config.json

SHA256 27d2a7e20ea3a3f837842eeb93860630a4f965f60e0794b29cb7dceebac40edf
MD5 2864e1aee62f98ac975c4cf4f12119d7
SHA1 5baf6c65f97d55515330eacc1cb4b68cc0478814
SHA512 db225fd37065e24af6575e697e951bb28eac7189d7f3055a5c9e88685f3c2bea4fa2a6dd0219057ea671513c8e6245a55abb568a29ceabf67713141baedb7057
MD5 SHA1 SHA512

Game-s2/pool_mine_example.cmd

SHA256 e73491065d86b1ad69229bb5d2019e08b947e11a2a57adf5c2d9a2b5d8f4acad
MD5 2e737f5c3af9c8aa5216dfdc5be02cc6
SHA1 05fe2040aea6f6cff25deaf5ca2ca6793faa64c7
SHA512 ce0e12a544623458f5905ea20f2b6f0e75cfb57add912290fbf2611eddbe98de7ffed3c9e650747967b2620e5ebbe33e249cbd60e7032bdb10c909cc516709ca
MD5 SHA1 SHA512

Game-s2/rtm_ghostrider_example.cmd

SHA256 810614290bdb14d2ddf10f65f8adc988a8272764f2a9e2c378e52fad162da344
MD5 3f0155abe745be1f6089eafc4f517ac8
SHA1 277f510ceb62b277b141d094c82eedebdc6f3a35
SHA512 8def46852a962ff5dbed94e01f8d23019ef401a718d9c5a440d12b2ffa369539be328f165f68ccc2098cd5e5c939bcb5f784f877bdd7b9d939393bbd2229d19e
MD5 SHA1 SHA512

Game-s2/solo_mine_example.cmd

SHA256 33497c69c21fa96bbc96f1d7f09608e462f8ab22555364977c0bd35fef27bc29
MD5 090703e56f46330ed625ac4363c9d25c
SHA1 6ce0b265e0860f1913f4bb37a17aa7eda88641c5
SHA512 1cd8c43287508c9393300d5a22c565d2f4bd98493a203112fd727518a4e439eb74035d18fe1f52e2d3594305a841ca93fcd0e3c61634f0992cfd3fc253872f19
MD5 SHA1 SHA512

Game-s2/start.cmd

SHA256 8e70ef38fe14a2ee2848df3d6f7e260d1caf8cfc15de694d678b8af151d62333
MD5 eaf3a00cc0465f8af471b849ada29843
SHA1 3042e97874706189aa9704d77c9e74a94e519106
SHA512 56b9f3991ae4bad5e06097d095931e746e6b2ac955649a5c793d9f4f6861c6ffc9316b063c34d7a8079af201354c87bf3008bc0fd4321e59b27e1d8120b078cf
MD5 SHA1 SHA512

Game-s2/xmrig.exe

IMPHASH 12806e48b853545b536463546db4baa1
SHA256 e199d88569fb54346d5fa20ee7b59b2ea6f16f4ecca3ea1e1c937b11aab7b2b0
MD5 c0f8959614ae06561216158d78a787e5
SHA1 73167d1fd0cee1c96a6505606d21cbfe4369eb00
SHA512 a24fcf344d08c64ac301d5e4979f062b5e28e8e4acf1d2790916149ffe7726b0c4a11e0775aeba6b841d2d5081e1bd13e2b80390bf9bfbc44d67e54ec07cd746
SSDEEP 98304:AwHlVzThdquIJ3mH6KfTSr2tJCkN3dOauqMAC2Taf43TZquOE2:fVz5CkN3dXuq9Taf4jLt2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4061668

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSASetLastError send recv ntohs htons htonl inet_addr inet_ntoa gethostbyaddr WSAGetLastError WSAIoctl gethostbyname WSARecvFrom WSASocketW WSASend WSARecv gethostname WSADuplicateSocketW getpeername FreeAddrInfoW GetAddrInfoW shutdown socket setsockopt listen connect closesocket bind WSACleanup WSAStartup select getsockopt getsockname ioctlsocket getservbyname getservbyport

iphlpapi

GetAdaptersAddresses

userenv

GetUserProfileDirectoryW

crypt32

CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty CertDuplicateCertificateContext

kernel32

GetStringTypeW InitializeCriticalSectionAndSpinCount WriteConsoleW SetConsoleTitleA GetStdHandle SetConsoleMode GetConsoleMode QueryPerformanceFrequency QueryPerformanceCounter SizeofResource LockResource LoadResource FindResourceW ExpandEnvironmentStringsA GetConsoleWindow GetSystemFirmwareTable HeapFree HeapAlloc GetProcessHeap MultiByteToWideChar SetPriorityClass GetCurrentProcess SetThreadPriority GetSystemPowerStatus GetCurrentThread GetProcAddress GetModuleHandleW GetTickCount CloseHandle FreeConsole VirtualProtect VirtualFree VirtualAlloc GetLargePageMinimum LocalAlloc GetLastError LocalFree FlushInstructionCache GetCurrentThreadId AddVectoredExceptionHandler DeviceIoControl GetModuleFileNameW CreateFileW SetLastError GetSystemTime SystemTimeToFileTime GetModuleHandleExW Sleep InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo SwitchToFiber DeleteFiber CreateFiberEx FindClose FindFirstFileW FindNextFileW WideCharToMultiByte GetSystemDirectoryA FreeLibrary LoadLibraryA FormatMessageA GetFileType WriteFile GetEnvironmentVariableW GetACP ConvertFiberToThread ConvertThreadToFiberEx GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryW ReadConsoleA ReadConsoleW PostQueuedCompletionStatus CreateFileA DuplicateHandle SetEvent ResetEvent WaitForSingleObject CreateEventA QueueUserWorkItem RegisterWaitForSingleObject UnregisterWait GetNumberOfConsoleInputEvents ReadConsoleInputW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW CreateDirectoryW FlushFileBuffers GetDiskFreeSpaceW GetFileAttributesW GetFileInformationByHandle CreateEventW RtlCaptureContext GetFullPathNameW ReadFile RemoveDirectoryW SetFilePointerEx SetFileTime MapViewOfFile FlushViewOfFile UnmapViewOfFile CreateFileMappingA ReOpenFile CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS ReleaseSemaphore ResumeThread GetNativeSystemInfo GetProcessAffinityMask SetThreadAffinityMask CreateSemaphoreA SetConsoleCtrlHandler GetCurrentDirectoryW GetLongPathNameW RtlUnwind CreateIoCompletionPort ReadDirectoryChangesW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetCurrentDirectoryW GetTempPathW GlobalMemoryStatusEx FileTimeToSystemTime K32GetProcessMemoryInfo SetHandleInformation CancelIoEx CancelIo SwitchToThread SetFileCompletionNotificationModes LoadLibraryExW SetErrorMode GetQueuedCompletionStatus ConnectNamedPipe SetNamedPipeHandleState PeekNamedPipe CreateNamedPipeW CancelSynchronousIo GetNamedPipeHandleStateA GetNamedPipeClientProcessId GetNamedPipeServerProcessId TerminateProcess GetExitCodeProcess UnregisterWaitEx LCMapStringW DebugBreak GetModuleHandleA LoadLibraryExA GetStartupInfoW GetModuleFileNameA GetVersionExA SetProcessAffinityMask GetComputerNameA FlsFree FlsSetValue FlsGetValue FlsAlloc GetCPInfo RtlLookupFunctionEntry GetFinalPathNameByHandleW RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetStdHandle GetCommandLineA GetCommandLineW CreateThread ExitThread FreeLibraryAndExitThread GetDriveTypeW SystemTimeToTzSpecificLocalTime ExitProcess GetFileAttributesExW SetFileAttributesW GetConsoleOutputCP CompareStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetTimeZoneInformation HeapSize SetEndOfFile FindFirstFileExW IsValidCodePage GetOEMCP GetFileSizeEx GetShortPathNameW CompareStringEx LCMapStringEx InitializeCriticalSectionEx WaitForSingleObjectEx GetExitCodeThread SleepConditionVariableSRW EncodePointer DecodePointer

user32

GetLastInputInfo MessageBoxW GetProcessWindowStation TranslateMessage GetUserObjectInformationW ShowWindow DispatchMessageA GetSystemMetrics MapVirtualKeyW GetMessageA

shell32

SHGetSpecialFolderPathA

ole32

CoInitializeEx CoUninitialize CoCreateInstance

advapi32

SystemFunction036 GetUserNameW ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW QueryServiceConfigA DeleteService ControlService StartServiceW OpenServiceW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken LsaOpenPolicy LsaAddAccountRights LsaClose GetTokenInformation

bcrypt

BCryptGenRandom

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

64KB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

169KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Game-s2.zip

Game-s2/SHA256SUMS

Game-s2/WinRing0x64.sys

PE Signature issue

ntoskrnl.exe

hal

generic

Game-s2/benchmark_10M.cmd

Game-s2/benchmark_1M.cmd

Game-s2/config.json

Game-s2/pool_mine_example.cmd

Game-s2/rtm_ghostrider_example.cmd

Game-s2/solo_mine_example.cmd

Game-s2/start.cmd

Game-s2/xmrig.exe

ws2_32

iphlpapi

userenv

crypt32

kernel32

user32

shell32

ole32

advapi32

bcrypt

generic

Sharing

General

Malware Config

Signatures

File Explorer

Game-s2.zip

Game-s2/SHA256SUMS

Game-s2/WinRing0x64.sys

PE Signature issue

ntoskrnl.exe

hal

generic

Game-s2/benchmark_10M.cmd

Game-s2/benchmark_1M.cmd

Game-s2/config.json

Game-s2/pool_mine_example.cmd

Game-s2/rtm_ghostrider_example.cmd

Game-s2/solo_mine_example.cmd

Game-s2/start.cmd

Game-s2/xmrig.exe

ws2_32

iphlpapi

userenv

crypt32

kernel32

user32

shell32

ole32

advapi32

bcrypt

generic