Behavioral task
behavioral1
Sample
f162c94c7c67802e7c8a487328ee394c01dddc7c672a5c7820dd05a4d59a75a9.exe
Resource
win7-20240705-en
General
-
Target
f162c94c7c67802e7c8a487328ee394c01dddc7c672a5c7820dd05a4d59a75a9
-
Size
3.0MB
-
MD5
411042b4c7c30e4dd33732432294308f
-
SHA1
3ea447769c14754397d0fcc155b3d5d595675962
-
SHA256
f162c94c7c67802e7c8a487328ee394c01dddc7c672a5c7820dd05a4d59a75a9
-
SHA512
adf12836558320fa6a97c92234bf94e0fea8be3903ef5208c953a0640df69c58148c02dbeb4e879e12e174b6e9e8ef86c8c5acc9a5aa9bd4c79c2d8e878d3851
-
SSDEEP
98304:w0GnJMOWPClFdx6e0EALKWVTffZiPAcRq6jHjc4+:wFWPClFO
Malware Config
Signatures
-
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f162c94c7c67802e7c8a487328ee394c01dddc7c672a5c7820dd05a4d59a75a9
Files
-
f162c94c7c67802e7c8a487328ee394c01dddc7c672a5c7820dd05a4d59a75a9.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 1.3MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 525KB - Virtual size: 528KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE