Overview

overview

10

Static

static

3

Video.scr

windows7-x64

10

Video.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Video.scr

  • Size

    6.0MB

  • Sample

    250124-ax3kca1kbv

  • MD5

    a9d4007c9419a6e8d55805b8f8f52de0

  • SHA1

    9f9d47ec6dd80bfcb4c3e0a1530b89d2d587c230

  • SHA256

    5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca

  • SHA512

    df727118e22be2c36c14bca3d084a7260f085bf528bfdc1da8467bc5adb654c34e20367ed733593810d9d54e9ca0137c015a4a34f09cb06d1145e60cbf16aecf

  • SSDEEP

    98304:RLVSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+jb5jC3ajz4F4VRc:HBfTCiUswVSLOJgyBGv5jGQW4VR

Score
10/10
xmrigdefense_evasiondiscoveryminerpersistenceprivilege_escalationpyinstallerupx

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    190.113.1.79
  • Port:
    21
  • Username:
    www

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    109.232.218.113
  • Port:
    21
  • Username:
    www
  • Password:
    anonymous

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    46.242.169.67
  • Port:
    21
  • Username:
    www
  • Password:
    anonymous

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    154.218.112.239
  • Port:
    21
  • Username:
    www
  • Password:
    anonymous

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    46.242.169.67
  • Port:
    21
  • Username:
    www
  • Password:
    123456

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    46.242.169.67
  • Port:
    21
  • Username:
    www
  • Password:
    admin

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    46.242.169.67
  • Port:
    21
  • Username:
    www
  • Password:
    root

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    46.242.169.67
  • Port:
    21
  • Username:
    www
  • Password:
    password

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    154.218.112.239
  • Port:
    21
  • Username:
    www
  • Password:
    123456

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    46.242.169.67
  • Port:
    21
  • Username:
    www
  • Password:
    123123

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    46.242.169.67
  • Port:
    21
  • Username:
    www
  • Password:
    123

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    46.242.169.67
  • Port:
    21
  • Username:
    www
  • Password:
    pass1234

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    46.242.169.67
  • Port:
    21
  • Username:
    www
  • Password:
    www

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    154.218.112.239
  • Port:
    21
  • Username:
    www
  • Password:
    admin

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    46.242.169.67
  • Port:
    21
  • Username:
    www
  • Password:
    wwwwww

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    179.189.199.213
  • Port:
    21
  • Username:
    www
  • Password:
    anonymous

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    142.11.209.33
  • Port:
    21
  • Username:
    www
  • Password:
    anonymous

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    146.59.15.138
  • Port:
    21
  • Username:
    www
  • Password:
    anonymous

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    45.95.188.159
  • Port:
    21
  • Username:
    www
  • Password:
    anonymous

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    142.11.209.33
  • Port:
    21
  • Username:
    www
  • Password:
    123456

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    45.95.188.159
  • Port:
    21
  • Username:
    www
  • Password:
    123456

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    142.11.209.33
  • Port:
    21
  • Username:
    www
  • Password:
    admin

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    45.95.188.159
  • Port:
    21
  • Username:
    www
  • Password:
    admin

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    142.11.209.33
  • Port:
    21
  • Username:
    www
  • Password:
    root

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    179.189.199.213
  • Port:
    21
  • Username:
    www
  • Password:
    123456

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    142.11.209.33
  • Port:
    21
  • Username:
    www
  • Password:
    password

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    142.11.209.33
  • Port:
    21
  • Username:
    www
  • Password:
    123123

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    146.59.15.138
  • Port:
    21
  • Username:
    www
  • Password:
    123456

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    179.189.199.213
  • Port:
    21
  • Username:
    www
  • Password:
    admin

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    179.189.199.213
  • Port:
    21
  • Username:
    www
  • Password:
    root

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    146.59.15.138
  • Port:
    21
  • Username:
    www
  • Password:
    admin

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    154.12.31.172
  • Port:
    21
  • Username:
    www
  • Password:
    anonymous

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    179.189.199.213
  • Port:
    21
  • Username:
    www
  • Password:
    password

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    146.59.15.138
  • Port:
    21
  • Username:
    www
  • Password:
    root

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    179.189.199.213
  • Port:
    21
  • Username:
    www
  • Password:
    123123

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    179.189.199.213
  • Port:
    21
  • Username:
    www
  • Password:
    123

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    154.12.31.172
  • Port:
    21
  • Username:
    www
  • Password:
    123456

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    146.59.15.138
  • Port:
    21
  • Username:
    www
  • Password:
    password

Targets

    • Target

      Video.scr

    • Size

      6.0MB

    • MD5

      a9d4007c9419a6e8d55805b8f8f52de0

    • SHA1

      9f9d47ec6dd80bfcb4c3e0a1530b89d2d587c230

    • SHA256

      5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca

    • SHA512

      df727118e22be2c36c14bca3d084a7260f085bf528bfdc1da8467bc5adb654c34e20367ed733593810d9d54e9ca0137c015a4a34f09cb06d1145e60cbf16aecf

    • SSDEEP

      98304:RLVSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+jb5jC3ajz4F4VRc:HBfTCiUswVSLOJgyBGv5jGQW4VR

    Score
    10/10
    xmrigdefense_evasiondiscoveryminerpersistenceprivilege_escalationpyinstallerupx

    • Xmrig family

      xmrig

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Contacts a large (551) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Modifies Windows Firewall

      defense_evasion

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks