xmrig | af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c

Sharing

Copy URL Twitter E-mail

General

Target
Photo.scr
Size 6.0MB
Sample260802-ww2gjsdr5v
SHA256 af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c
MD5 a20727b81b50a20483ba59ae65443dfe
SHA1 7429f81064e044e981de12bde015117953b7b0e7
SHA512 c6b857207818f1e26065ac424ee5cfdb18e5297ae8c1724a5ec8e80cf96b43bcd31b479859fa863ff508030ce52c60870152b433d548df9fbfc42a378c499856
SSDEEP 98304:RLGSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+Y2naq8le+:YBfTCiUswVSLOJgyBG/aW+
TLSH
T167563362F440E436E038203925F684A6B17DFD7347254A8B73A93A364D793D836BDB4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
anonymous

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
123456

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
admin

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
root

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
password

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
123123

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
123

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
pass1234

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
www

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
wwwwww

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
www1

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
www123

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
www2016

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
www2015

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
www!

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
P@ssw0rd!!

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
qwa123

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
12345678

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
test

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
123qwe!@#

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
123456789

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
123321

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
1314520

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
159357

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
www2017

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
666666

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
woaini

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
fuckyou

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
000000

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
1234567890

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
8888888

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
qwerty

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
1qaz2wsx

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
abc123

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
abc123456

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
1q2w3e4r

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
123qwe

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
www2019

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
www2018

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
p@ssw0rd

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
p@55w0rd

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
password!

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
p@ssw0rd!

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
password1

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
r00t

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
tomcat

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
5201314

Extracted

Credentials

Protocol
ftp
Host
158.101.23.106
Port
21
Username
www
Password
system

Targets

- Target
  Photo.scr
- Size 6.0MB
- SHA256 af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c
- MD5 a20727b81b50a20483ba59ae65443dfe
- SHA1 7429f81064e044e981de12bde015117953b7b0e7
- SHA512 c6b857207818f1e26065ac424ee5cfdb18e5297ae8c1724a5ec8e80cf96b43bcd31b479859fa863ff508030ce52c60870152b433d548df9fbfc42a378c499856
- SSDEEP 98304:RLGSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+Y2naq8le+:YBfTCiUswVSLOJgyBG/aW+
- TLSH
  T167563362F440E436E038203925F684A6B17DFD7347254A8B73A93A364D793D836BDB4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation pyinstaller upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- XMRig Miner payload
  miner
- Modifies Windows Firewall
  defense_evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Family: xmrig

Creates a large amount of network flows

XMRig Miner payload

Modifies Windows Firewall

ACProtect 1.3x - 1.4x DLL software

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2