Extracted

• • Target

    miner.exe

  • Size

    104KB

  • MD5

    4a9f5b7664e2ebf47aa5fc4240dc8a22

  • SHA1

    d0fc11aab0181df38d193cf8dfd1843fe06c844a

  • SHA256

    5c5374eb9054e48c5ab9c6ef21c2bd228fe2e63eaa0ae83dbdb65dd1a7429369

  • SHA512

    f45224b584b64d4ac32d4e6303ad87b2902ea310ac332ed0a0c7a706df2441eb0ef1f5076fe2716d004e59aa6a8e9e5e5e3a8f012008f05aef05064ad1e1eed6

  • SSDEEP

    192:xjZaDMFEa4ajXPeeZnXwqXTyE1hEjjTyXfan55tfMcePLiZmGhTuRY9SRXiKqiRh:hp4ajGCnXGMsGXfwldJ99Sjvb99Sjv

  Score

  10^/10

  xmrigxwormexecutionminerrattrojan

  • Detect Xworm Payload

  • XMRig Miner payload

    miner

  • Xmrig family

    xmrig

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1