Extracted

Extracted

• • Target

    Silent Crypto Miner/Newtonsoft.Json.dll

  • Size

    695KB

  • MD5

    195ffb7167db3219b217c4fd439eedd6

  • SHA1

    1e76e6099570ede620b76ed47cf8d03a936d49f8

  • SHA256

    e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

  • SHA512

    56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

  • SSDEEP

    12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/

  Score

  1^/10
  behavioral1behavioral2

• • Target

    Silent Crypto Miner/Silent Crypto Miner.exe

  • Size

    255KB

  • MD5

    854a42e9a581b2a33ceda0f3d3dd2f04

  • SHA1

    a100a400e570039823c4fd79dc470c13ccfbb266

  • SHA256

    fae4297f765a1c93fef48d7bddd8c88e6361dcb7eb9efc7cb10ff050e2157d80

  • SHA512

    569dc63dc90b1a6efebb9130d2dce133d3600937a1a6440575037b2b8d36b6aff8c607b86ba2ff0192324ed9cbae519e8a4aa3d9dd6e4b3b6f9d8483e043e1c0

  • SSDEEP

    3072:y1hoF2jJ6wiPa1XzwIxJLp7tUE1NgBS5Bs//dm63NzzEfHs/FtMtO2NcSINUc9nR:y1hnJ6D1IxPtUyNrsHdmqEfETrSc9nCu

  Score

  10^/10

  redlinesectopratxwormmetindefense_evasiondiscoveryexecutioninfostealerpersistencerattrojan

  • Detect Xworm Payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Sectoprat family

    sectoprat

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral3behavioral4

• • Target

    Silent Crypto Miner/System.Buffers.dll

  • Size

    20KB

  • MD5

    a48936868abf91274def7231aa52dbb5

  • SHA1

    f02fa5231536c0dd9cef9e84e609646b23d5d33c

  • SHA256

    423200010a7684763451473a4fb206dfa074fc8249676621ef9d9a13417d364d

  • SHA512

    c8fe3d1314794ae7071a647e328a46a30e6d96e574daa896fcebebf6bb51ce0af14e6cc63a0e1600a0e4adbc7aa18e97ee58581adccac23981c029ea782b5f9d

  • SSDEEP

    384:ay/fjFwUI/KQyVvKdDhG6ISDFWvYW8aIcyHRN7WEg2ly0:auhMaVmzDC6b

  Score

  1^/10
  behavioral5behavioral6

• • Target

    Silent Crypto Miner/System.Memory.dll

  • Size

    138KB

  • MD5

    f09441a1ee47fb3e6571a3a448e05baf

  • SHA1

    3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde

  • SHA256

    bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f

  • SHA512

    0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6

  • SSDEEP

    3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU

  Score

  1^/10
  behavioral7behavioral8

• • Target

    Silent Crypto Miner/System.Numerics.Vectors.dll

  • Size

    113KB

  • MD5

    aaa2cbf14e06e9d3586d8a4ed455db33

  • SHA1

    3d216458740ad5cb05bc5f7c3491cde44a1e5df0

  • SHA256

    1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183

  • SHA512

    0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8

  • SSDEEP

    1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS

  Score

  1^/10
  behavioral10behavioral9

• • Target

    Silent Crypto Miner/System.Runtime.CompilerServices.Unsafe.dll

  • Size

    16KB

  • MD5

    c4cfe03f75bc01969bc936c9c09baa12

  • SHA1

    cb96ea48ee8aa9fe764d6f1ec30751001a0a646d

  • SHA256

    a2d38a330df390cc739689369a36520fe491d3660d73974eb46b51608f50675b

  • SHA512

    6db15403523b6c966d7aa6906cfc219a956f6c7a68c60774e9ed9f261df1a4d6731b92c59f3caafaeb345b853cd237fa163155b8b8e7825ba69a634878c929e2

  • SSDEEP

    192:RMyaqO8cxdQWXYWJeaotWsI9A9GaHnhWgN7aJeWwgCWuXqnaju02aU:RTO9dQWXYW8aocyHRN7WEgSly0

  Score

  1^/10
  behavioral11behavioral12