Extracted

• • Target
    fe7fe23e0022d5c01eb91e3a9f0e9306868075ed9baacb78fe565204c6576120.bin
  • Size 2.6MB
  • SHA256 fe7fe23e0022d5c01eb91e3a9f0e9306868075ed9baacb78fe565204c6576120
  • MD5 5ddbf34d0c12ee05573fb7e21e68317b
  • SHA1 1476c34eb93938b4c29b0bffa3bf3fecb0b10980
  • SHA512 204a9aa523bdcb7342ef3e5d1d7a66260aed14b1f6a866f6493f52b0fbb01da46762ad4ae68501279fd14b54352a2d703b696f6f94f0b3ce57eca8578540d5c4
  • SSDEEP 49152:/xlkSNDFq7Di2a4Dot5Vq7/dV9y+QzS5hpcYg+0BVg6Fc1VaMh9Q:/xlkSN572a4DCg7oxzSzpciygwuQ
  • TLSH
    T1D9D533178E0D96FAEBB7C979FC64F8CAA4E540AC7557D14CE2037AAEEC42C51B0A3111
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionxmrigxwormminerpersistencerattrojanupx

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2