xmrig | 298c2442e7ae156de1ebfefa96b23bfe2e4c3ffd81a92ef2d5fe0de0dd3d6111 | Triage

Sharing

General

Target

298c2442e7ae156de1ebfefa96b23bfe2e4c3ffd81a92ef2d5fe0de0dd3d6111
Size

1.5MB
MD5

101ef026dc33833e75af47e98ca73c71
SHA1

da406bea870fa0159826046afbf58ca2d7382722
SHA256

298c2442e7ae156de1ebfefa96b23bfe2e4c3ffd81a92ef2d5fe0de0dd3d6111
SHA512

4b7d71695740a3486c2414383f1cbc1d50658346e690d4c4c477b9d981fb7b49006be360c79c7f28fd2a1d7fd59fd883715c5b6dafd798476668e779fb579481
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRx3QZj0nRO21:GemTLkNdfE0pZyD

Score

10^/10

miner xmrig

Malware Config

Signatures

XMRig Miner payload 1 IoCs

resource	yara_rule
sample	xmrig

Xmrig family
xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
298c2442e7ae156de1ebfefa96b23bfe2e4c3ffd81a92ef2d5fe0de0dd3d6111

Files

298c2442e7ae156de1ebfefa96b23bfe2e4c3ffd81a92ef2d5fe0de0dd3d6111
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 619KB - Virtual size: 619KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_TEXT_CN
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_TEXT_CN
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ