NBMiner_42[.]3_Win[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

NBMiner_42.3_Win.zip
Size

11.0MB
MD5

081f90969881d3d3384a3ebaab9bf286
SHA1

3273388a756c689bb96e40aaf1f603190e4ac33f
SHA256

064a6f04e0d22df684b433fef4fd23fd90f4b4ab5ec3d0ff9f8af63571e83444
SHA512

feaf98866190baad4f8e1756ee9db9be2a274e7795db3fe47bb54855c35852e79d9c358d85ea011ee64f90df1928abcc6ec3595ad740331a2b068de30584d97b
SSDEEP

196608:EyPxYXzGfAUWMJpgle6i6UyfR2LhLiekXj4fGI7TLQ0vqbrJfnJbuhPaj8LpD3x2:EyxqzGfjWMJpgk5a2d+JKQ0vwfhQCj8S

Score

1^/10

Malware Config

Signatures

Files

NBMiner_42.3_Win.zip
.zip
Start-Clore.bat
Start-Conflux.bat
Start-Ergo.bat
Start-Ethereum-Classic.bat
Start-Ethereum-POW.bat
Start-Neurai.bat
Start-Ravencoin.bat
modify_tdr_delay.reg
nbminer.exe
.exe windows:6 windows x64 arch:x64

bd5e4e5f645408e15fe7064ed8f7b46d

Code Sign

a7:f3:9e:96:e0:42:fb:85:de:05:31:31:f5:3e:53:51
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

14/12/2020, 00:00

Not After

14/12/2021, 23:59

Subject

CN=珠海源泽咨询有限公司,O=珠海源泽咨询有限公司,POSTALCODE=519031,STREET=横琴新区宝华路6号105室-48741(集中办公区),L=珠海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:f3:9e:96:e0:42:fb:85:de:05:31:31:f5:3e:53:51
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

14/12/2020, 00:00

Not After

14/12/2021, 23:59

Subject

CN=珠海源泽咨询有限公司,O=珠海源泽咨询有限公司,POSTALCODE=519031,STREET=横琴新区宝华路6号105室-48741(集中办公区),L=珠海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:36:a3:50:5f:b5:29:05:6b:ca:44:28:38:33:4b:1f:14:67:d7:9d:af:24:22:e6:0f:af:76:d9:12:1e:df:d8
Signer

Actual PE Digest

30:36:a3:50:5f:b5:29:05:6b:ca:44:28:38:33:4b:1f:14:67:d7:9d:af:24:22:e6:0f:af:76:d9:12:1e:df:d8

Digest Algorithm

sha256

PE Digest Matches

true

cb:15:ad:c6:1a:ce:8c:2e:87:b8:9d:11:40:de:d8:1f:46:c7:e0:14
Signer

Actual PE Digest

cb:15:ad:c6:1a:ce:8c:2e:87:b8:9d:11:40:de:d8:1f:46:c7:e0:14

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

select

kernel32

GetVersionExW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

shell32

ord680

pdh

PdhGetFormattedCounterValue

advapi32

RegQueryInfoKeyW

version

GetFileVersionInfoW

ntdll

VerSetConditionMask

cfgmgr32

CM_Get_Child

bcrypt

BCryptGenRandom

userenv

GetUserProfileDirectoryW

netapi32

NetShareEnum

ole32

CoTaskMemFree

user32

SetTimer
CharUpperBuffW

winmm

timeSetEvent

dnsapi

DnsQuery_W

iphlpapi

ConvertInterfaceLuidToIndex

crypt32

CertCloseStore

Exports

Exports

NvOptimusEnablementCuda

Sections

.text
Size: - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 5.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 234KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: - Virtual size: 106B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.p8e
Size: - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

./?l
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.eH*
Size: 11.4MB - Virtual size: 11.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 434B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
nbminer.exe.sha256
open_web_monitor.url
.url
readme.md

Sharing

General

Malware Config

Signatures

Files

bd5e4e5f645408e15fe7064ed8f7b46d

Code Sign

a7:f3:9e:96:e0:42:fb:85:de:05:31:31:f5:3e:53:51Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

a7:f3:9e:96:e0:42:fb:85:de:05:31:31:f5:3e:53:51Certificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

30:36:a3:50:5f:b5:29:05:6b:ca:44:28:38:33:4b:1f:14:67:d7:9d:af:24:22:e6:0f:af:76:d9:12:1e:df:d8Signer

cb:15:ad:c6:1a:ce:8c:2e:87:b8:9d:11:40:de:d8:1f:46:c7:e0:14Signer

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

shell32

pdh

advapi32

version

ntdll

cfgmgr32

bcrypt

userenv

netapi32

ole32

user32

winmm

dnsapi

iphlpapi

crypt32

Exports

Exports

Sections

.text Size: - Virtual size: 5.8MB

.rdata Size: - Virtual size: 5.9MB

.data Size: - Virtual size: 149KB

.pdata Size: - Virtual size: 234KB

.qtmetad Size: - Virtual size: 106B

.p8e Size: - Virtual size: 3.6MB

./?l Size: 5KB - Virtual size: 5KB

.eH* Size: 11.4MB - Virtual size: 11.4MB

.rsrc Size: 512B - Virtual size: 434B

a7:f3:9e:96:e0:42:fb:85:de:05:31:31:f5:3e:53:51
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

a7:f3:9e:96:e0:42:fb:85:de:05:31:31:f5:3e:53:51
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

30:36:a3:50:5f:b5:29:05:6b:ca:44:28:38:33:4b:1f:14:67:d7:9d:af:24:22:e6:0f:af:76:d9:12:1e:df:d8
Signer

cb:15:ad:c6:1a:ce:8c:2e:87:b8:9d:11:40:de:d8:1f:46:c7:e0:14
Signer

.text
Size: - Virtual size: 5.8MB

.rdata
Size: - Virtual size: 5.9MB

.data
Size: - Virtual size: 149KB

.pdata
Size: - Virtual size: 234KB

.qtmetad
Size: - Virtual size: 106B

.p8e
Size: - Virtual size: 3.6MB

./?l
Size: 5KB - Virtual size: 5KB

.eH*
Size: 11.4MB - Virtual size: 11.4MB

.rsrc
Size: 512B - Virtual size: 434B