xmrig

Sharing

Copy URL Twitter E-mail

General

Target
842e2bcd8f9cc4479d129b390fc81b3a9c8d0921b907fd0ba10ff802835b66d8
Size 13.3MB
Sample241104-fd1jjatjay
SHA256 842e2bcd8f9cc4479d129b390fc81b3a9c8d0921b907fd0ba10ff802835b66d8
MD5 caa4ae11ed30fcd54f5df98e0520bb21
SHA1 c39df0818251292bcffa7cf1d79aaa0c9589c27e
SHA512 82f7de686d289812d3da51545ca0f20702df131f8bf85066405589ecc6e7e8184e8e0bec6409d03957be61be963bd9c22d361d6fb4bd30f91e66b49ddaecf1c2
SSDEEP 393216:anl0Cp3LGoj4pYuanSIQgDcwfda2RdViPgOKDWGa1chVC4s:EH3s2glgg2a2diIP7VC4s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  FSCapture-10.5-CN/bin/423Down.url
- Size 209B
- SHA256 93585a844b68e62ad7aa69b013b7f10d8b949a7f35af0b9b6b823aa526f7af8f
- MD5 6d2178f6fbf26d009562415daf5a2cb7
- SHA1 60804c9f71460d19cbf5a7b30f5d467c7547803c
- SHA512 95a39fd75abd54dd017b229fdbccb522bd78113ec80586e5ddf81d9787e854853535f983b9bedbcad4ae0d54c792c97721ab93a454ee513622e52a81474b2fd3
- MD5 SHA1 SHA512
Score

6^/10

discovery evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2
- Target
  FSCapture-10.5-CN/bin/FSCIcon.db
- Size 39KB
- SHA256 3cc8478f1de6ba82347702f74a0a413105189c26238123c6de21635d751ffd80
- MD5 e4dd6134f0da16b24f9df1bba0969f55
- SHA1 4ced9e445246fcd570e42acc85bce4f89ae4736d
- SHA512 e19495dfa70a803fbdd6c974a17c26277809bf251c0da7bb81bd12e6f44b35e5f34f7944c2bb2b823f85ab0b7048a7d3761d52ca793249b168984d93e9c90e58
- SSDEEP 96:nPtA/dChd6kwoSJNAngD+PLKIoyNSjcWTvR0MHm////////////IXDlw2RjbGS7f:ni0hd5HUUtoyIjcWTOMHhxAivM3
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  FSCapture-10.5-CN/bin/FSCPlugin01.dll
- Size 319KB
- SHA256 cf66f927d6d3ebc77d93567c25c9577803e5fb64201755d7773257c4c3ed5d2b
- MD5 f421919da3cb7c44b086210d4d797d7a
- SHA1 cdca33c63f6fae255a6f64bdca62bd8dbc7032dc
- SHA512 bb98bfdbea713ae19da38cb3cfaa4f2c54a5af2c9adc8a80eea415f45eb07005307733589fcf54f407a090e5e6c228fac3ff654f4aa71cb861265d6b41a01472
- SSDEEP 6144:Iu/M8/CrMeIS4iB7ncZzPnRGpk2WQvg1+i/X5NKP5NCs/lwaj2Qy:l/Anc1x2Wj5NKPqs92Qy
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  FSCapture-10.5-CN/bin/FSCPlugin02.dll
- Size 3.5MB
- SHA256 4ef58566d20eae8ed18177da8fcabbc55a5585cc5cc51806ef86e136291ac1f1
- MD5 a3101addc099361a751198614972d5fa
- SHA1 9379ec77c520c19cd698369aef6acdc4e32ee10d
- SHA512 a0ae4a9bf7ba7af8b539ceb77aca1f21c27a6ac6b418737559263e2c5084568e9a821e7c8101cf7e1da5f00a677cfac528185bf31e0c67bf76a1d4174da70f37
- SSDEEP 49152:IhFXzHdg+4U90CBP+uKC7kqzDLS0l1W4D1T:+dbUC
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  FSCapture-10.5-CN/bin/FSCPlugin03.dll
- Size 2.2MB
- SHA256 fb8c862b1e2c2f423dde036b9d77f241951674dc5e6ee51954f2b37e19bca378
- MD5 fc610b497818bcb5249e72410aed5162
- SHA1 3da9e3fef84300fbda10fdc9e97250d1fb4367a2
- SHA512 4f23bea8ba7bf51dce14437fe5209b3b3209c1d6d7f8912fa91fa734a98cb92bed129cdee8ebfddfd22fcf42d90b5944e5d64e026ff531527b705664fab8b3e4
- SSDEEP 24576:x1+Sus1HRBOcDtwCpFf4fMaJj8C7hkEcw32Ig1BJS/AcOWdg0DZMK0jwUAHxala:NJzVAjj8uo1nSocOsDZMoDHxk
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  FSCapture-10.5-CN/bin/FSCPlugin04.dll
- Size 1.6MB
- SHA256 4c32447d4b2e332501bb808df6039f3473f917c9e9311aa896316be9ea13e80b
- MD5 892e8de79a793e25980d6266793f4117
- SHA1 8e05aec70286cb01966a8af3c3e34f01d403be5a
- SHA512 5d110860292ff7458842fb7f1c5d1a92689a5ec547054b10fc96439c3efa43c6abaa228519e30df2146a1141ea4667446841082f4d0b6bd94c3bb71e262aa5df
- SSDEEP 24576:VoExeBz7WVAOfBMrraVUTvUc/qntXPi0vUHlXyjYuwydiHJGKti69srFCxlalU4c:5LfCro+GPW9Hy5KtnICaLmOY
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  FSCapture-10.5-CN/bin/FSCPlugin05.dll
- Size 117KB
- SHA256 3d2877a8d739f682fb5323c00d568483f8c878c6ac745de5f0d0caa7ffa3788a
- MD5 70c3f6892684641080c6ffe2f32b9bda
- SHA1 cbb401c44a17e85e54e73b0c716cd5e819ff6421
- SHA512 d1341d4e190ea4109a15a99e4119b2559c0d330df43ab2ed6605f454e9f7012fd42fa75dde9a8290c366fbf50b4d44d36548e35568bc510b974fa4cfe47f7f30
- SSDEEP 3072:yuJnXnJMBIrVDtuUFAWoULBRmBrv8qKxs:yYXfpxuUFZDBR8h
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  FSCapture-10.5-CN/bin/FSCapture.exe
- Size 7.0MB
- SHA256 c569fceb42b865772778398201774861c563b5a4e09c7db5be63288d864ac1ea
- MD5 ded434ab1dd64d33fe36102d1d8b3962
- SHA1 f3ff25cf038f8966312990392e6a8d7626eaa201
- SHA512 7aa903c6f3853b0ec9d30edfddc9318ba8ad7f49b0e058de532632c19767678c2499bae9a5b6c7e53214d7dc05e65b14cf19628093de409dc6e3fb14c7989f1a
- SSDEEP 196608:YrD8jBvF38z1os53eauL7q/vTqiXJdmrbf6EzNleb:Y8jlF3rsl/vTqiqbfRPeb
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  FSCapture-10.5-CN/bin/FSCrossHair.exe
- Size 631KB
- SHA256 c0bcb458d844158f42f8be4da7187008115f849ff25d85aa00fa8637869ede2f
- MD5 effb23ab4ece53d5e07c8c0437d86bbe
- SHA1 b695bda41c3b115375025b6a11e6e2cfe740eaee
- SHA512 cabffd4a53524a681db07784f5c8517545f730abec1adf5c79da4a91a61295eec266313ff631c1cdf2389c564c2d448a7b323a6122674617ba130e7f9b0a9f16
- SSDEEP 12288:hIRXXg5ro19GsHuRwX6ZLs+O3EoKhjkiYkKhtmfCllQtpP/Z63iwwoZRr:hI+oGZRwqZLPO6jkiUf3lUP/Z63iwwoT
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  FSCapture-10.5-CN/bin/FSFocus.exe
- Size 636KB
- SHA256 493b2b08ecadd1895c4fcfe0ffd9c7b2b4f5b276ccd494846e0cb35de004ad91
- MD5 97aa518d2a3b2ad63573128c7e10e6c5
- SHA1 88cd0bc2496025a7979393807dcc089ba09bd9e8
- SHA512 1a77895b740191ccdfcb3377528ef1b907bc138297d5eea7bcefa23d65ebcbcc11f29eba70151c570928eca099c2c87a1ae1d94226a19dbb0c2ee459ac371256
- SSDEEP 12288:9IuPNeBhqk/28pUgna9ref4+/dFPfwCXrUhgIZXu8C6Z:9IkeBVpRna98dlzeu8b
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  FSCapture-10.5-CN/bin/FSRecorder.exe
- Size 5.5MB
- SHA256 d380be40d27a92839944082d484ac33563b20229e3dbd6b225f3d774d18a7aba
- MD5 81e7eceed3a93a7d08406fb5dab3ca28
- SHA1 7629d03c4318194da90f1dd68ad4fa34ab51171e
- SHA512 bd348f2ffe5a7bae855790a46162c84ab5e02e28d4e70f45c39f54aad5fb71c8b87bd8ec970d24650a6003ff83b0ec5999523f458b7dbfc88200079837e468c1
- SSDEEP 98304:9NKn9MOr7hy3mATwNs15bYYrr3jvz2rbfbry:nKn9dY3mATwNa5bY4zefbry
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  FSCapture-10.5-CN/bin/libsharpyuv.dll
- Size 104KB
- SHA256 d34fb573dbb827161a4ffb22a6f06f8ac30778ccc5c8b173950b9d49ba2795c2
- MD5 0ce639618b3e361efa1b09cf8ffe3d95
- SHA1 a1a08b5914a16772ccd9d699d938115e1618d424
- SHA512 249d12f438cf25c42a1ecc3f0bbf10e985dd88c7e5f3137c757ef5e6614d33fc3916675f32481b7bb448464ca37bb5e20b088d7e0bccbf17525f07d42969a976
- SSDEEP 1536:/ZZZg5wwcuBil+UaTJwb6Y2FadNyPLxbuvtmgMbFuQh5gRbbbbbbbGUvy+yx:DDkjtqwIAg0FuQh5g0Uv
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  FSCapture-10.5-CN/bin/libwebp.dll
- Size 491KB
- SHA256 56a31bf39a191303f1b4d8766f481b974d35f3e39eb9525d8e4e88989f7b6f0d
- MD5 ef19b06ff151b46589de08cdd17f5282
- SHA1 ba552c68fb231615731cfaef3703feaaca7b5794
- SHA512 c87cded8b3e7d954785534764c7665d08a5b4e30a8e1f8c4ed3d017bb9c27c64944c9c3c95bb0832b6b17c3ee86412ba23f4ca215fcdcd792002e5e64e02f2ad
- SSDEEP 6144:kee+bf9cK2+k5NkwaFmMNf6HMdeI3aji2ek+OKHepZwgL7SCr+Sf9EAOmDGPnc:q8Me6IA1ek+/SVEU+
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  FSCapture-10.5-CN/bin/re/lib/CrashReporting.bat
- Size 297B
- SHA256 0e0878dcfc98f47a14e9eca075fdd1c2dcec6397f73b93c545fb26e4d6c1784f
- MD5 e6dbc17aa2a36550f8270f32a098a798
- SHA1 66f251fa6ef24baa8cb7e31aa656d462847239cd
- SHA512 1bb8cc733aa1051479cc22361fba56e7b5bc9eb15dea7f3f1713a51178eb1698c5aba19d2366c1475d273a30453d3d19693611d7a8be67d459b6589052fb1beb
- MD5 SHA1 SHA512
Score

10^/10

xmrig defense_evasion miner privilege_escalation
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral27 behavioral28
- Target
  FSCapture-10.5-CN/bin/re/lib/FSCapture_license.exe
- Size 7.4MB
- SHA256 af36bb1797146886b03ff5c1baaa112e5a096fe44fdaeb8c3697c69312cd5611
- MD5 d6d29befb8ab66846a8c83e1849daaeb
- SHA1 ebb5d31a0391eb8f782df9d61af27a2baffebc70
- SHA512 29a4e3177a49b3268672208842be6d6e42f149dce3869ce616a2558bb6f300b29f9c65aa30327cd26ec26de4558043b3796ada0985ac75417505bca763b63760
- SSDEEP 98304:ynhB6JTPw9H3GYEIrcMGmMEP6mOB9LktYG/SIdz0H+AhgNWnf+A+jN7hxhyb7NYi:yfKBMyziyVm9s+AQ7i
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

xmrig miner
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
behavioral29 behavioral30
- Target
  FSCapture-10.5-CN/bin/re/lib/WinRing0x64.sys
- Size 14KB
- SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
- MD5 0c0195c48b6b8582fa6f6373032118da
- SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
- SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
- SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks whether UAC is enabled

Xmrig family

XMRig Miner payload

Checks computer location settings

Xmrig family

xmrig

XMRig Miner payload

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32