xmrig.exe
First submission 2024-10-14 23:33:04
Last sumbission 2024-10-17 08:22:04
File details
| File type: | PE32+ executable (console) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 6215.0 KB (6364160 bytes) |
| Compile time: | 2024-08-11 20:16:41 |
| MD5: | 5fba8ae226b096da3b31de0e17496735 |
| SHA1: | d532a01254cf9e0229d3c5803b78ff7c9b0cb8d3 |
| SHA256: | ca28f4aeaa5e16d216cd828b67454a56f3c7feeb242412d26ed914fadff20d40 |
| Import Hash : | 12806e48b853545b536463546db4baa1 |
| Sections 10 | .text .rdata .data .pdata _RANDOMX _TEXT_CN _TEXT_CN _RDATA .rsrc .reloc |
| Directories 5 | import resource debug tls relocation |
File features detected
Signed
XOR
OSINT Enrichments
| Virus Total: | 59/77 VT report date: 2024-10-14 09:23:32 |
| Malware Type 3 | miner trojan pua |
| Threat Type 3 | bitminer vsntil24 xmrig |
URLs, FQDN and IP indicators 2
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://144.34.162.13/xmrig.exe  |
144.34.162.13 |
2024-10-17 08:22:10 |
| hXXp://fish.hackbiji.cc/xmrig.exe |
fish.hackbiji.cc |
2024-10-14 23:33:04 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x41a478 | 4302336 | 8e907f8cdd0f129cef928a090d8a58561fd03afc | 7bfa50ff80e175efdc3f63b945917ffd | |
| .rdata | 0x41c000 | 0x1a6e22 | 1732608 | 42194d00efaf19f259e8568816b7f39bb81e4943 | 45ad955dcfec3415d214ef4e759878b5 | |
| .data | 0x5c3000 | 0x2af4d4 | 66048 | 7f818196ffd27ec2a931c518f3dcee71498343aa | 21bcb66e26a5153208ee0e5b0674ac6a | |
| .pdata | 0x873000 | 0x2a528 | 173568 | 13493fdbca6ed08919103a701533a91ea857a0d0 | 3216f277e28eeb2a10e798f3c405f411 | |
| _RANDOMX | 0x89e000 | 0xc56 | 3584 | 11bd5b6446d56158259a24b938f7c4959bd56e21 | 9ee63642b94966ecb630ee0843e46b26 | |
| _TEXT_CN | 0x89f000 | 0x26d1 | 10240 | 91d62ae67c7e250650c5d785cffb0a794da2f085 | afea7882aa31e5987db2f12b8933de56 | |
| _TEXT_CN | 0x8a2000 | 0x1184 | 4608 | 4992a8b9c3e33a7f8659bd20066f907134f7c337 | 409bf3f918f2402291cb56c2e9354b47 | |
| _RDATA | 0x8a4000 | 0xf4 | 512 | 01b502d92676cfa20dd538708d40786d1d4bc8a4 | 9e68fee697a3137ad662934ab8ec793e | |
| .rsrc | 0x8a5000 | 0x59c8 | 23040 | d5a9514d367b9aadc371fc5c17de64bb4a03c2b7 | 7f3f3f5f465203df366d3144803e1e11 | |
| .reloc | 0x8ab000 | 0xb5a0 | 46592 | 084c4db1a836b0eb982c191e08412c5bd677a158 | 2db71728c819782830a4bc6de4955950 |
PE Resources 4
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x8aa110 | 1128 | |
| RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x8aa578 | 62 | |
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x8aa5b8 | 652 | |
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x8aa848 | 381 |
Meta infos 8
| LegalCopyright: | Copyright (C) 2016-2024 xmrig.com |
| ProductVersion: | 6.22.0 |
| CompanyName: | www.xmrig.com |
| FileVersion: | 6.22.0 |
| FileDescription: | XMRig miner |
| Translation: | 0x0000 0x04b0 |
| OriginalFilename: | xmrig.exe |
| ProductName: | XMRig |
Packers detected 2
| Microsoft Visual C++ 8.0 (DLL) |
| Microsoft Visual C++ 8.0 |
Anti debug functions 6
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 1
| Bochs & QEmu CPUID Trick |
Strings analysis - File found
| XML |
| topology.xml |
| Library |
| api-ms-win-core-synch-l1-2-0.dll |
| mscoree.dll |
| ntdll.dll |
| KERNEL32.dll |
| ADVAPI32.dll |
| SHELL32.dll |
| Powrprof.dll |
| USER32.dll |
| IPHLPAPI.DLL |
| atiadlxx.dll |
| opencl.dll |
| WS2_32.dll |
| xmrig-cuda.dll |
| %PROGRAMFILES%\NVIDIA Corporation\NVSMI\nvml.dll |
| USERENV.dll |
| nvml.dll |
| bcrypt.dll |
| ole32.dll |
| Crypt32.dll |
| %s.dll |
| PSAPI.DLL |
Strings analysis - Possible IPs found 25
| 1.3.111.2 |
| 1.3.101.111 |
| 1.3.101.110 |
| 1.3.101.113 |
| 1.3.101.112 |
| 127.0.0.1 |
| 1.3.36.3 |
| 1.3.6.1 |
| 3.1.9.9 |
| 3.1.9.4 |
| 3.1.9.3 |
| 3.1.9.1 |
| 3.1.9.29 |
| 3.1.9.49 |
| 3.1.9.21 |
| 1.3.14.3 |
| 3.1.9.23 |
| 3.1.9.44 |
| 3.1.9.43 |
| 3.1.9.24 |
| 3.1.9.41 |
| 101.3.4.1 |
| 101.3.4.2 |
| 61.1.1.1 |
| 1.9.16.3 |
Strings analysis - Possible URLs found 5
| http:// |
| https://xmrig.com/wizard |
| https://xmrig.com/benchmark/%s |
| https:// |
| https://xmrig.com/docs/algorithms |