xmrig | 5a6fc2af764ad62dbaf36eb358045ef372f6bf9bb49b55ed383b096e3ea6724b

General

Target
Xeno.exe
Size 3.5MB
Sample260930-qztm8azyav
SHA256 5a6fc2af764ad62dbaf36eb358045ef372f6bf9bb49b55ed383b096e3ea6724b
MD5 350da995d65af7d4fb924cd4a0519a41
SHA1 0933ef7eaadccf0fa60df91346ebc5da4e4fa376
SHA512 36c8a1a14dd2c0e448bfe58627a514d252ab4bef2693063237055764a70b77a717715615c89460f0b2a6f9f2a4d1d5f826787bb33841b77acaed27e6d59d8a5c
SSDEEP 49152:lQp/oLWKikLDWGE2GPSItiwC3sU+99oZMxtfZKROa1zKdNG3UTe:iALW7oWiwCsU+kZMxtfba1zKdA
TLSH
T16F06BE122275E626C379977E0150C50117E97B089FD6DB12F3C86DE7EEE1782A72E02B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Xeno.exe
- Size 3.5MB
- SHA256 5a6fc2af764ad62dbaf36eb358045ef372f6bf9bb49b55ed383b096e3ea6724b
- MD5 350da995d65af7d4fb924cd4a0519a41
- SHA1 0933ef7eaadccf0fa60df91346ebc5da4e4fa376
- SHA512 36c8a1a14dd2c0e448bfe58627a514d252ab4bef2693063237055764a70b77a717715615c89460f0b2a6f9f2a4d1d5f826787bb33841b77acaed27e6d59d8a5c
- SSDEEP 49152:lQp/oLWKikLDWGE2GPSItiwC3sU+99oZMxtfZKROa1zKdNG3UTe:iALW7oWiwCsU+kZMxtfba1zKdA
- TLSH
  T16F06BE122275E626C379977E0150C50117E97B089FD6DB12F3C86DE7EEE1782A72E02B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware collection defense_evasion discovery execution xmrig miner persistence privilege_escalation spyware stealer
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Modifies WinLogon for persistence
  persistence
- XMRig Miner payload
  miner
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1