xmrig | JaffaCakes118_8567eb5d3f57644208a31607605026602e135616aa051f6b4b221da3f0dc8103

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_8567eb5d3f57644208a31607605026602e135616aa051f6b4b221da3f0dc8103
Size

15.0MB
MD5

7c1d78669ef944e238567d5fd72e8145
SHA1

c9af8ed6cc47c630a92a234fa2977744fbe765eb
SHA256

8567eb5d3f57644208a31607605026602e135616aa051f6b4b221da3f0dc8103
SHA512

8a9fba9454fa6c59a8c470b05299632a21c702519f9b8e80ec37b4c1d943804d19374e95609314237eab9eecc1a3c0997ed89d6bdf5a51a14d2b04807a63a06b
SSDEEP

98304:epRCtuGExFJsLfteVaDoyE2XM/VxVBvLAX7Lsvhq:BQGExoLfM4DoyE2c/VxV2X7r

Score

10^/10

miner xmrig

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
sample	xmrig
sample	family_xmrig

Xmrig family
xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_8567eb5d3f57644208a31607605026602e135616aa051f6b4b221da3f0dc8103

Files

JaffaCakes118_8567eb5d3f57644208a31607605026602e135616aa051f6b4b221da3f0dc8103
.exe windows:6 windows x64 arch:x64

5351daab729c77b6d4e70fba24430146

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\admin\Desktop\toolchain\xxx-master\build\Debug\xmmrig.pdb

Imports

ws2_32

shutdown
ntohs
recv
select
WSASendTo
WSARecvFrom
WSASocketW
WSASend
WSARecv
WSAIoctl
WSAGetOverlappedResult
WSADuplicateSocketW
htons
getpeername
FreeAddrInfoW
GetAddrInfoW
gethostname
htonl
socket
setsockopt
listen
connect
closesocket
bind
accept
WSACleanup
WSAStartup
gethostbyname
getsockopt
getsockname
ioctlsocket
getnameinfo
freeaddrinfo
getaddrinfo
WSAGetLastError
WSASetLastError
send

iphlpapi

GetAdaptersAddresses
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToNameW

userenv

GetUserProfileDirectoryW

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFreeCertificateContext
CertFindCertificateInStore

kernel32

SetConsoleMode
SetConsoleTitleA
LoadResource
LockResource
SizeofResource
FindResourceW
ExpandEnvironmentStringsA
HeapAlloc
HeapFree
GetProcessHeap
GetSystemFirmwareTable
MultiByteToWideChar
GetCurrentProcess
GetCurrentThread
SetThreadPriority
SetPriorityClass
GetTickCount
GetModuleHandleW
GetProcAddress
GetSystemPowerStatus
CloseHandle
FreeConsole
GetConsoleWindow
GetLastError
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
GetLargePageMinimum
LocalAlloc
LocalFree
AddVectoredExceptionHandler
GetCurrentThreadId
CreateFileW
DeviceIoControl
GetModuleFileNameW
SetLastError
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
GetFileType
WriteFile
FormatMessageW
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryA
LoadLibraryW
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
PostQueuedCompletionStatus
CreateFileA
DuplicateHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
Sleep
QueueUserWorkItem
RegisterWaitForSingleObject
UnregisterWait
GetNumberOfConsoleInputEvents
ReadConsoleInputW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
WriteConsoleInputW
VerSetConditionMask
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetUnhandledExceptionFilter
SetCurrentDirectoryW
GetStdHandle
GetTempPathW
QueryPerformanceFrequency
InitializeCriticalSection
GetProcessTimes
GetPriorityClass
OpenProcess
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExW
GetProcessIoCounters
VerifyVersionInfoA
FileTimeToSystemTime
GetConsoleTitleW
SetConsoleTitleW
K32GetProcessMemoryInfo
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateDirectoryW
FlushFileBuffers
GetDiskFreeSpaceW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFinalPathNameByHandleW
GetFullPathNameW
ReadFile
RemoveDirectoryW
SetFilePointerEx
SetFileTime
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingA
ReOpenFile
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
RtlUnwind
SetConsoleCtrlHandler
GetLongPathNameW
GetShortPathNameW
CreateIoCompletionPort
ReadDirectoryChangesW
SetHandleInformation
CancelIo
SwitchToThread
SetFileCompletionNotificationModes
LoadLibraryExW
FormatMessageA
SetErrorMode
GetQueuedCompletionStatus
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
ReleaseSemaphore
CreateSemaphoreW
ResumeThread
GetNativeSystemInfo
CreateSemaphoreA
ConnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
CreateNamedPipeW
WaitNamedPipeW
CancelIoEx
CancelSynchronousIo
CreateNamedPipeA
GetNamedPipeHandleStateA
TerminateProcess
GetExitCodeProcess
CreateProcessW
UnregisterWaitEx
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
LCMapStringW
DebugBreak
GetModuleHandleA
GetStartupInfoW
GetModuleFileNameA
GetVersionExA
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
GetComputerNameA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RaiseException
IsDebuggerPresent
CreateEventW
GetStringTypeW
GetLocaleInfoEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
GetConsoleMode
WriteConsoleW
GetCurrentDirectoryW
UnhandledExceptionFilter
IsProcessorFeaturePresent
VirtualQuery
InitializeSListHead
RtlPcToFileHeader
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
HeapSize
HeapValidate
SetStdHandle
GetCommandLineA
GetCommandLineW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
ExitProcess
GetFileAttributesExW
SetFileAttributesW
GetConsoleOutputCP
HeapReAlloc
HeapQueryInformation
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
CompareStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
SetEnvironmentVariableW
CreateSymbolicLinkW
CreateThreadpoolTimer
CloseThreadpoolWork
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
WaitForSingleObjectEx
GetExitCodeThread
SleepConditionVariableSRW
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
SetFileInformationByHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork

user32

GetMessageA
ShowWindow
GetSystemMetrics
MapVirtualKeyW
DispatchMessageA
TranslateMessage
GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW
GetLastInputInfo

shell32

SHGetSpecialFolderPathA

advapi32

SetSecurityInfo
GetSecurityInfo
SetEntriesInAclA
FreeSid
AllocateAndInitializeSid
SystemFunction036
RegGetValueW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetUserNameW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
StartServiceW
QueryServiceStatus
QueryServiceConfigA
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
LsaAddAccountRights
LsaOpenPolicy
LsaClose
LookupPrivilegeValueW
GetTokenInformation
AdjustTokenPrivileges
OpenProcessToken

bcrypt

BCryptGenRandom

Sections

.text
Size: 11.3MB - Virtual size: 11.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 204KB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 424KB - Virtual size: 423KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RANDOMX
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_SHA3_25
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_TEXT_CN
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_TEXT_CN
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 337B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 1024B - Virtual size: 546B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5351daab729c77b6d4e70fba24430146

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

iphlpapi

userenv

crypt32

kernel32

user32

shell32

advapi32

bcrypt

Sections

.text Size: 11.3MB - Virtual size: 11.3MB

.rdata Size: 2.7MB - Virtual size: 2.7MB

.data Size: 204KB - Virtual size: 4.0MB

.pdata Size: 424KB - Virtual size: 423KB

.idata Size: 17KB - Virtual size: 16KB

.tls Size: 1024B - Virtual size: 808B

_RANDOMX Size: 4KB - Virtual size: 4KB

_SHA3_25 Size: 3KB - Virtual size: 3KB

_TEXT_CN Size: 9KB - Virtual size: 9KB

_TEXT_CN Size: 6KB - Virtual size: 5KB

.00cfg Size: 512B - Virtual size: 337B

_RDATA Size: 1024B - Virtual size: 546B

.rsrc Size: 184KB - Virtual size: 184KB

.reloc Size: 110KB - Virtual size: 110KB

.text
Size: 11.3MB - Virtual size: 11.3MB

.rdata
Size: 2.7MB - Virtual size: 2.7MB

.data
Size: 204KB - Virtual size: 4.0MB

.pdata
Size: 424KB - Virtual size: 423KB

.idata
Size: 17KB - Virtual size: 16KB

.tls
Size: 1024B - Virtual size: 808B

_RANDOMX
Size: 4KB - Virtual size: 4KB

_SHA3_25
Size: 3KB - Virtual size: 3KB

_TEXT_CN
Size: 9KB - Virtual size: 9KB

_TEXT_CN
Size: 6KB - Virtual size: 5KB

.00cfg
Size: 512B - Virtual size: 337B

_RDATA
Size: 1024B - Virtual size: 546B

.rsrc
Size: 184KB - Virtual size: 184KB

.reloc
Size: 110KB - Virtual size: 110KB