Extracted

• • Target

    mBBBgvD.exe

  • Size

    2.3MB

  • MD5

    120b148606efb6400aa3aeb9ce44a668

  • SHA1

    e7488d6d0893c4d074f69718c8ee32da42d98207

  • SHA256

    607626fde0a0263edd41db4721523682cb343600ef083fc78f23f04ca8be04b1

  • SHA512

    6a5888c08f9378805978f53fd01a93dcc7f202198c12e57376c794e3f60d04c1b67dd6f51156c2ded32ae318cf73baa2b9f811fe1e99de4ddc86ac35bc2a2a43

  • SSDEEP

    49152:W1vr8uwYtUeKFj/c2e4r7XplKVZo0juLx1hZf18E2yujq3:W1freFj/c2e4rinaj8E2hg

  Score

  10^/10

  xmrigxwormdiscoveryminerrattrojan

  • Detect Xworm Payload

  • Xmrig family

    xmrig

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2