xmrig | af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c

Sharing

Copy URL Twitter E-mail

General

Target
AV.scr
Size 6.0MB
Sample260909-phm9favfrc
SHA256 af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c
MD5 a20727b81b50a20483ba59ae65443dfe
SHA1 7429f81064e044e981de12bde015117953b7b0e7
SHA512 c6b857207818f1e26065ac424ee5cfdb18e5297ae8c1724a5ec8e80cf96b43bcd31b479859fa863ff508030ce52c60870152b433d548df9fbfc42a378c499856
SSDEEP 98304:RLGSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+Y2naq8le+:YBfTCiUswVSLOJgyBG/aW+
TLSH
T167563362F440E436E038203925F684A6B17DFD7347254A8B73A93A364D793D836BDB4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
anonymous

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
123456

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
admin

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
root

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
password

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
123123

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
123

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
pass1234

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
www

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
wwwwww

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
www1

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
www123

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
www2016

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
www2015

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
www!

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
P@ssw0rd!!

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
qwa123

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
12345678

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
test

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
123qwe!@#

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
123456789

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
123321

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
1314520

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
159357

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
www2017

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
666666

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
woaini

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
fuckyou

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
000000

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
1234567890

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
8888888

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
qwerty

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
1qaz2wsx

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
abc123

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
abc123456

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
1q2w3e4r

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
123qwe

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
www2019

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
www2018

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
p@ssw0rd

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
p@55w0rd

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
password!

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
p@ssw0rd!

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
password1

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
r00t

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
tomcat

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
5201314

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
system

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
pass

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
1234

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
12345

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
1234567

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
devry

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
111111

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
admin123

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
derok010101

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
windows

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
[email protected]

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
qazxswedc`123

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
qwerty123456

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
www
Password
qazxswedc

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
anonymous
Password
anonymous

Extracted

Credentials

Protocol
ftp
Host
39.96.63.127
Port
21
Username
anonymous
Password
123456

Targets

- Target
  AV.scr
- Size 6.0MB
- SHA256 af94ddf7c35b9d9f016a5a4b232b43e071d59c6beb1560ba76df20df7b49ca4c
- MD5 a20727b81b50a20483ba59ae65443dfe
- SHA1 7429f81064e044e981de12bde015117953b7b0e7
- SHA512 c6b857207818f1e26065ac424ee5cfdb18e5297ae8c1724a5ec8e80cf96b43bcd31b479859fa863ff508030ce52c60870152b433d548df9fbfc42a378c499856
- SSDEEP 98304:RLGSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+Y2naq8le+:YBfTCiUswVSLOJgyBG/aW+
- TLSH
  T167563362F440E436E038203925F684A6B17DFD7347254A8B73A93A364D793D836BDB4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation pyinstaller upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- XMRig Miner payload
  miner
- Boot or Logon Autostart Execution: Port Monitors
  Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
  persistence
- Modifies Windows Firewall
  defense_evasion
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Family: xmrig

Creates a large amount of network flows

XMRig Miner payload

Boot or Logon Autostart Execution: Port Monitors

Modifies Windows Firewall

ACProtect 1.3x - 1.4x DLL software

Executes dropped EXE

Loads dropped DLL

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1