xmrig.exe
First submission 2024-10-14 23:54:01
Last sumbission 2024-10-15 20:52:03
File details
| File type: | PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 8036.0 KB (8228864 bytes) |
| Compile time: | 2022-10-23 13:02:20 |
| MD5: | 6f4532e49d65c2be0355b222f96e06e8 |
| SHA1: | 268e90ce25e01bbb205f6ae3f493f8da36a61480 |
| SHA256: | acaf8e844ef7f4f65033ebe9546c394cc21bce175dac8b59199106309f04e5ab |
| Import Hash : | 3ae5019c0ca1f8d34f2e86c2a0eed3b9 |
| Sections 11 | .text .data .rdata .pdata .xdata .bss .idata .CRT .tls .rsrc .reloc |
| Directories 4 | import resource tls relocation |
File features detected
Signed
XOR
OSINT Enrichments
| Virus Total: | 61/77 VT report date: 2024-09-30 00:20:50 |
| Malware Type 3 | miner pua trojan |
| Threat Type 3 | bitminer malxmr miswf |
URLs, FQDN and IP indicators 2
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://main.dsn.ovh/mvt/xmrig.exe  |
main.dsn.ovh |
2024-10-15 20:52:08 |
| hXXp://193.70.43.137/mvt/xmrig.exe |
193.70.43.137 |
2024-10-14 23:54:01 |
PE Sections 2 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x5eb648 | 6209536 | d530af3d33011440f8d4d9ddb5c8dee182e0f962 | c71a0c414aafb7c5e68fe4a91ee363de | |
| .data | 0x5ed000 | 0x10460 | 67072 | b4175fc5a9dd0dc605a2685e3195616aac5d96be | 21c158633eb21cb3082b12ef690ef770 | |
| .rdata | 0x5fe000 | 0x15d660 | 1431552 | 0be682954f9b12735e054d065757bdc06c40a912 | 4892ffd89593896b04995dda93fc7740 | |
| .pdata | 0x75c000 | 0x2ee0c | 192512 | 76d2f35625fcfd8e0d0ef6238bed39d9598ecabb | cb7b5909bd56d355b34c2de2794e776e | |
| .xdata | 0x78b000 | 0x3b7a8 | 243712 | 6be866a65c96b3e62a004ce2bc8d814559a1d689 | 034812933b8d93588a6e07c869330b0e | |
| .bss | 0x7c7000 | 0x3209e0 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
| .idata | 0xae8000 | 0x46bc | 18432 | 31ebb6dc2b1edbfc69659f3fa0940405282603bf | 16c8e5eb84a912fcd1c0688153007c7a | |
| .CRT | 0xaed000 | 0x68 | 512 | 79f31a588d691ac9e196d84b4aff6da5b1128147 | d95fbb6ad6bb6c672d871d0f95c6eb92 | |
| .tls | 0xaee000 | 0x10 | 512 | 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 | bf619eac0cdf3f68d496ea9344137e8b | |
| .rsrc | 0xaef000 | 0x5ce8 | 23784 | 069b1d0b71124b655c6367c4851b8acffeb0f28e | 297c59286282976bae3d9f48f19e2e0c | |
| .reloc | 0xaf5000 | 0x8e78 | 36864 | 3f752ffbb917258d63988b74302bdd5d5e6f472b | d654838a44178bf5fc89286bbb658947 |
PE Resources 4
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xaf4110 | 1128 | |
| RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xaf4578 | 62 | |
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xaf45b8 | 652 | |
| RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xaf4848 | 1167 |
Meta infos 8
| LegalCopyright: | Copyright (C) 2016-2022 xmrig.com |
| ProductVersion: | 6.18.1 |
| CompanyName: | www.xmrig.com |
| FileVersion: | 6.18.1 |
| FileDescription: | XMRig miner |
| Translation: | 0x0000 0x04b0 |
| OriginalFilename: | xmrig.exe |
| ProductName: | XMRig |
Packers detected 1
| Microsoft Visual C++ 8.0 (DLL) |
Anti debug functions 7
| GetLastError |
| IsDebuggerPresent |
| OutputDebugStringA |
| Process32First |
| Process32Next |
| RaiseException |
| TerminateProcess |
Anti debug functions 1
| Bochs & QEmu CPUID Trick |
Strings analysis - File found
| XML |
| topology.xml |
| Library |
| ntdll.dll |
| MSVCRT.dll |
| ADVAPI32.dll |
| KERNEL32.dll |
| SHELL32.dll |
| Powrprof.dll |
| USER32.dll |
| IPHLPAPI.DLL |
| atiadlxx.dll |
| PSAPI.DLL |
| @ntdll.dll |
| WS2_32.dll |
| xmrig-cuda.dll |
| %PROGRAMFILES%\NVIDIA Corporation\NVSMI\nvml.dll |
| USERENV.dll |
| nvml.dll |
| ole32.dll |
| Crypt32.dll |
| opencl.dll |
| %s.dll |
Strings analysis - Possible IPs found 1
| 127.0.0.1 |
Strings analysis - Possible URLs found 7
| https://xmrig.com/wizard |
| https://xmrig.com/docs/algorithms |
| http:// |
| https://L) |
| https://xmrig.com/benchmark/%s |
| https:// |
| https://H |