Overview

overview

10

Static

static

10

92da30b3ab...dN.exe

windows7-x64

10

92da30b3ab...dN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN

  • Size

    1.2MB

  • Sample

    240919-gtdv5svblj

  • MD5

    4bad10d3641267de09f4378970fe2980

  • SHA1

    39112bb6dca6c439a4b21cf5329f5fb7fa420765

  • SHA256

    92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0d

  • SHA512

    a4344e14568ece22cbe6d445217ad370b1b72a446d970f971c3f5d1a2b18aeb034f35eedae2ce5e135952f1d31028ff6068fcdf9293320b6e97f0e2c68231f69

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675ESA6:Lz071uv4BPMkFfdg6f

Score
10/10
xmrigexecutionminerpersistenceprivilege_escalationupx

Malware Config

Targets

    • Target

      92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0dN

    • Size

      1.2MB

    • MD5

      4bad10d3641267de09f4378970fe2980

    • SHA1

      39112bb6dca6c439a4b21cf5329f5fb7fa420765

    • SHA256

      92da30b3ab0dcaa593e232d8b2fe6ba8928a2fed047e096bc8a354034b35cc0d

    • SHA512

      a4344e14568ece22cbe6d445217ad370b1b72a446d970f971c3f5d1a2b18aeb034f35eedae2ce5e135952f1d31028ff6068fcdf9293320b6e97f0e2c68231f69

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675ESA6:Lz071uv4BPMkFfdg6f

    Score
    10/10
    xmrigexecutionminerpersistenceprivilege_escalationupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks