General
-
Target
bdab58b9c915ad76e0c82f87ad437309c12c4ddb767cb55dda9274a842f480e6.exe
-
Size
2.5MB
-
Sample
241027-vppczazdlb
-
MD5
be8ad341fc7cdff8f03ae184f097fa7e
-
SHA1
2e8211ebb0bdcde47b717b2c97028387ef059a0b
-
SHA256
bdab58b9c915ad76e0c82f87ad437309c12c4ddb767cb55dda9274a842f480e6
-
SHA512
eb9b0b2536d6a9dcb4d08e208145bec17422d67b38b2f471d32fca3bb48feeba8cce00fc3a90447f12e6a27c89577acfa9d0a8117a3e03fa3df4210cf28aaf52
-
SSDEEP
49152:2dKUMPWt+GJjY5/MXTuFQ4M3Z6CBurFwj2qgUj7f4bmGTfenjdp:YMPWt+GJdXTuPMZ6Cgrc2JUAlTWnpp
Static task
static1
Behavioral task
behavioral1
Sample
bdab58b9c915ad76e0c82f87ad437309c12c4ddb767cb55dda9274a842f480e6.exe
Resource
win7-20241010-en
Malware Config
Targets
-
-
Target
bdab58b9c915ad76e0c82f87ad437309c12c4ddb767cb55dda9274a842f480e6.exe
-
Size
2.5MB
-
MD5
be8ad341fc7cdff8f03ae184f097fa7e
-
SHA1
2e8211ebb0bdcde47b717b2c97028387ef059a0b
-
SHA256
bdab58b9c915ad76e0c82f87ad437309c12c4ddb767cb55dda9274a842f480e6
-
SHA512
eb9b0b2536d6a9dcb4d08e208145bec17422d67b38b2f471d32fca3bb48feeba8cce00fc3a90447f12e6a27c89577acfa9d0a8117a3e03fa3df4210cf28aaf52
-
SSDEEP
49152:2dKUMPWt+GJjY5/MXTuFQ4M3Z6CBurFwj2qgUj7f4bmGTfenjdp:YMPWt+GJdXTuPMZ6Cgrc2JUAlTWnpp
-
Xmrig family
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s)
-
Executes dropped EXE
-
Loads dropped DLL
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-