Overview

overview

10

Static

static

10

0423b5659a...78.exe

windows7-x64

10

0423b5659a...78.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0423b5659ad0aff940aef3530d3dc41d9c11eb7565e57348f939d98c04e77e78.exe

  • Size

    1.6MB

  • Sample

    241118-pc2vmswla1

  • MD5

    6e8973edb75ebc2a257a752f858661a7

  • SHA1

    4aa5fb5f5211bb1d0598154bc5d447c526f8a435

  • SHA256

    0423b5659ad0aff940aef3530d3dc41d9c11eb7565e57348f939d98c04e77e78

  • SHA512

    1ee2e74fc76dda6f2bba679069e781466ed62a0a58d4432580997bf678e39e7f1597c718fa0c00bce156fefef55e9c909220414cdf879653cf3dd73552a76e96

  • SSDEEP

    49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHqJ:NABm

Score
10/10
xmrigexecutionminerupx

Malware Config

Targets

    • Target

      0423b5659ad0aff940aef3530d3dc41d9c11eb7565e57348f939d98c04e77e78.exe

    • Size

      1.6MB

    • MD5

      6e8973edb75ebc2a257a752f858661a7

    • SHA1

      4aa5fb5f5211bb1d0598154bc5d447c526f8a435

    • SHA256

      0423b5659ad0aff940aef3530d3dc41d9c11eb7565e57348f939d98c04e77e78

    • SHA512

      1ee2e74fc76dda6f2bba679069e781466ed62a0a58d4432580997bf678e39e7f1597c718fa0c00bce156fefef55e9c909220414cdf879653cf3dd73552a76e96

    • SSDEEP

      49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHqJ:NABm

    Score
    10/10
    xmrigexecutionminerupx

    • Xmrig family

      xmrig

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks