xmrig | 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca

Sharing

Copy URL Twitter E-mail

General

Target
Photo.scr
Size 6.0MB
Sample260728-g68w2sff94
SHA256 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca
MD5 a9d4007c9419a6e8d55805b8f8f52de0
SHA1 9f9d47ec6dd80bfcb4c3e0a1530b89d2d587c230
SHA512 df727118e22be2c36c14bca3d084a7260f085bf528bfdc1da8467bc5adb654c34e20367ed733593810d9d54e9ca0137c015a4a34f09cb06d1145e60cbf16aecf
SSDEEP 98304:RLVSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+jb5jC3ajz4F4VRc:HBfTCiUswVSLOJgyBGv5jGQW4VR
TLSH
T13F563355F0405826F039107A34F988A2B07DFC724B7559CBB3A83E761E353E8267DA9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
anonymous

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
123456

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
admin

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
root

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
password

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
123123

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
123

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
pass1234

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
www

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
wwwwww

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
www1

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
www123

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
www2016

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
www2015

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
www!

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
P@ssw0rd!!

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
qwa123

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
12345678

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
test

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
123qwe!@#

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
123456789

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
123321

Extracted

Credentials

Protocol
ftp
Host
47.112.208.121
Port
21
Username
www
Password
1314520

Targets

- Target
  Photo.scr
- Size 6.0MB
- SHA256 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca
- MD5 a9d4007c9419a6e8d55805b8f8f52de0
- SHA1 9f9d47ec6dd80bfcb4c3e0a1530b89d2d587c230
- SHA512 df727118e22be2c36c14bca3d084a7260f085bf528bfdc1da8467bc5adb654c34e20367ed733593810d9d54e9ca0137c015a4a34f09cb06d1145e60cbf16aecf
- SSDEEP 98304:RLVSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+jb5jC3ajz4F4VRc:HBfTCiUswVSLOJgyBGv5jGQW4VR
- TLSH
  T13F563355F0405826F039107A34F988A2B07DFC724B7559CBB3A83E761E353E8267DA9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation pyinstaller upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- XMRig Miner payload
  miner
- Boot or Logon Autostart Execution: Port Monitors
  Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
  persistence
- Modifies Windows Firewall
  defense_evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2