xmrig | 5ee9ae6e79365744f0082b7918f0ccd47f49d63f19c3b40b9bbdb54c8f486746

Sharing

Copy URL Twitter E-mail

General

Target
corvusminer.zip
Size 2.8MB
Sample260727-vmwn9scc26
SHA256 5ee9ae6e79365744f0082b7918f0ccd47f49d63f19c3b40b9bbdb54c8f486746
MD5 eff87c9299965bb83bf2fc7925ee0079
SHA1 a67de205e371adb58ffc9e1a51aa762fb371bfea
SHA512 c4dec62b7ce61e53d57fba0d23995f54b8054bd43a8939a79ec67fc1f8900cac346eff5ccfd9d7251162607f43cd81a443b88ee9826f3357f12e638ef9203ce9
SSDEEP 49152:F8Fr6BtcMBUyBOT/dGm7w4h1IciCxtxYOWSUNsqR7vBOwTK17whLXR3YTVHWy3MF:FYWEMBq/dO4HdxHYwUh7K17wdhohu
TLSH
T1A6D53351B0A6FA67A08D99B1C8D48C9BA089EF3C9D17D08C4C4A0DE5F8495E30BD3BF5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  corvusminer.zip
- Size 2.8MB
- SHA256 5ee9ae6e79365744f0082b7918f0ccd47f49d63f19c3b40b9bbdb54c8f486746
- MD5 eff87c9299965bb83bf2fc7925ee0079
- SHA1 a67de205e371adb58ffc9e1a51aa762fb371bfea
- SHA512 c4dec62b7ce61e53d57fba0d23995f54b8054bd43a8939a79ec67fc1f8900cac346eff5ccfd9d7251162607f43cd81a443b88ee9826f3357f12e638ef9203ce9
- SSDEEP 49152:F8Fr6BtcMBUyBOT/dGm7w4h1IciCxtxYOWSUNsqR7vBOwTK17whLXR3YTVHWy3MF:FYWEMBq/dO4HdxHYwUh7K17wdhohu
- TLSH
  T1A6D53351B0A6FA67A08D99B1C8D48C9BA089EF3C9D17D08C4C4A0DE5F8495E30BD3BF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  config.json
- Size 215B
- SHA256 dd687283843cad0a36999a67852af4b27d56ce54a49ff8086088b8e2309d38fe
- MD5 0dae6032a9463bb571011c833cac6863
- SHA1 59ae0e86808ce3ca34d020494d9b366dcf0e41b3
- SHA512 739317adb66d840486b5a9220ba2623857dc7eb35d22b762eea7166f51e0bb3b92db64533aeeda22965791fbbc6af13aea7796eae8e5d90b91444086e321c814
- TLSH
  T1C5D0A71594109B37C2B633D01A715316B1222ABF275C6C0630723644C5B94B62821746
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  corvusminer-windows-amd64.dll
- Size 322KB
- SHA256 8719fb4c2a16e708a3e6402e3bf8fe3ccbdeb3bd88903db02103d18deb4b73cd
- MD5 7767458953b85080927ff6df633a1a6f
- SHA1 1380da35726fe0a8ce8b338b185fc28d00ae5636
- SHA512 b6122368e649b6f9ba7a967028296c1448e71f31e500ddbe515656f802c1806524806dcde826b76a8ed58d9d0e65c9eddbd761fc293bd31d3b1a3b0848c6f9d0
- SSDEEP 6144:3ULLd4sNjLAvBdKTG8N5f5tNgxW1DbIdsH:ELLSslL0BdCDP7SW1HIdsH
- TLSH
  T1E7646D82B3C95DD9C6178239899BD376B238F8D407635B574B24B2311F22ED0BE96783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  corvusminer.css
- Size 2KB
- SHA256 852ba55025b0b7f7369c1259fd73b468a6f95394603c3dea015853aac3929063
- MD5 9c408233f88a5ca44916f00f5b270ed1
- SHA1 5a73daf2d6e109bb2923738ea6f6adbb8698f14c
- SHA512 07a2b1a474fe561231eedae682f24141aba1f0af62f35e19c33c36243683922dcb5678d65819bfdb52d7ca3068f41667ad7f2d64d6f9e775ecf54a19003f7c64
- TLSH
  T1C4411EE7BFA95409B40B95B478929B82B32DA117801DCD7CABF4307CBD441AC5A32A5C
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8
- Target
  corvusminer.html
- Size 3KB
- SHA256 d78a8d263a805893bd7f5cc9d1c7a5c23289ac5d1617612a75e5157159399fd6
- MD5 5a969c4b9b0a6204b91276201ef651c5
- SHA1 a5a39c47ab633a20fa2ae81f7b817554448175da
- SHA512 aa4ae7f67a2d1b7f7b95c19c63e4646a94a806b6b05e27c9edf44b0ebff7104f76db6bbc3b2cbdaf358b7b6cc96388cf1133a113ae5af0c7c52fa1eac99be00b
- TLSH
  T16061DE34B4F156B3C053A4E92DD5AB197EC14247C707950CB1FC9B858FE6C868B2B46B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  corvusminer.js
- Size 6KB
- SHA256 474ada722ab26bba73e0b028f455f00df0553aa9930e5840788067e0932ff789
- MD5 b251151a2f32e5cc51062f0f53c0a4c4
- SHA1 19a7e6cc2495099c027fbcebcbbb230ac4795343
- SHA512 78f6cea76138d9977f0442a866cbcb6aaea5fae145e0653b9f94e4c3b890a0a6b0b0a2190fa7b61fe479b23135ce81f3014f4981463b470e4d458d2c19929918
- SSDEEP 192:dBhjrVbLu1UdAS5WEJi0iNi0SI6901b587Xar/cMKroi7BsyT4Waj:dT1aSwwi0iWL0zaarcMKNBir
- TLSH
  T12ED1873230BB94330FFE605D969B12163D66D2433907DC60B6BC4318DF5ED089A77AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  signature.json
- Size 198B
- SHA256 c8f1320a873e2a5fc1669a931d369cc4003dd73c6ed7a3d0bdbeca4b08e8e558
- MD5 34b3e89f7134ca19ac64a91d3d7ee026
- SHA1 d5e1311699042fbc11b28e099416d72136e12588
- SHA512 8dc7312539db7e194fa8b56a9fcfbf7fb1ca1231d2918218339080db04d2cb88ded3e56931566ce69674c0557b1398294f46a5cc034d0d63e46108aa09a02e5b
- TLSH
  T191D022268070B071A4EC804B0A1810DA829678DB00E12F120B1AA60C19CCC2EA3E027E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  xmrig.exe
- Size 6.3MB
- SHA256 db33acee83403cf81fef9f26897b64ec4cdee37200726fa9b1e1519293846ed9
- MD5 1a449d62195693395072365340b10ad2
- SHA1 d33abc620823bbc50cbfee9fada5563e8525e138
- SHA512 ee7de46820bc4f6c65fba635964fb6301c12206d06256ef42d1c940ab046db48aa4f5b31a9c3eb3ec85991d2239810f9dba1e20276ad8060c2df1c9217d6c987
- SSDEEP 98304:/QFeFhxyuuUs+I7AVLx3cfZwM74rcSzPNBCj+kCXnIzooMyJ+pYfW+prxosgLKN7:rIzbJ+ifW+lKLKNr4Zx2
- TLSH
  T17D669D6AB7E400E8C86AC17CC6569613E7B2B8595370EBDB17B456A91F237D10F3EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16