SYMBOLCOMMON_NAMEaka. SYNONYMS
win.monero_miner (Back to overview)

Monero Miner

aka: CoinMiner

There is no description at this point.

References
2017-09-28ESET ResearchPeter Kálnai, Michal Poslušný
@online{klnai:20170928:moneymaking:ac6e685, author = {Peter Kálnai and Michal Poslušný}, title = {{Money‑making machine: Monero‑mining malware}}, date = {2017-09-28}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2017/09/28/monero-money-mining-malware/}, language = {English}, urldate = {2019-11-14} } Money‑making machine: Monero‑mining malware
Monero Miner
Yara Rules
[TLP:WHITE] win_monero_miner_auto (20200529 | autogenerated rule brought to you by yara-signator)
rule win_monero_miner_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-05-30"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.4.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.monero_miner"
        malpedia_rule_date = "20200529"
        malpedia_hash = "92c362319514e5a6da26204961446caa3a8b32a8"
        malpedia_version = "20200529"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b5c247c 13b424bc040000 894c2470 8b4c2478 89742474 89c6 01c1 }
            // n = 7, score = 100
            //   8b5c247c             | mov                 ebx, dword ptr [esp + 0x7c]
            //   13b424bc040000       | adc                 esi, dword ptr [esp + 0x4bc]
            //   894c2470             | mov                 dword ptr [esp + 0x70], ecx
            //   8b4c2478             | mov                 ecx, dword ptr [esp + 0x78]
            //   89742474             | mov                 dword ptr [esp + 0x74], esi
            //   89c6                 | mov                 esi, eax
            //   01c1                 | add                 ecx, eax

        $sequence_1 = { 899424ac030000 898424b0030000 8b536c 8b4370 89ac24b4030000 898c24b8030000 8b6b74 }
            // n = 7, score = 100
            //   899424ac030000       | mov                 dword ptr [esp + 0x3ac], edx
            //   898424b0030000       | mov                 dword ptr [esp + 0x3b0], eax
            //   8b536c               | mov                 edx, dword ptr [ebx + 0x6c]
            //   8b4370               | mov                 eax, dword ptr [ebx + 0x70]
            //   89ac24b4030000       | mov                 dword ptr [esp + 0x3b4], ebp
            //   898c24b8030000       | mov                 dword ptr [esp + 0x3b8], ecx
            //   8b6b74               | mov                 ebp, dword ptr [ebx + 0x74]

        $sequence_2 = { 8b842418050000 89d3 89bc24d0010000 31d5 8b7c2460 89ac24d4010000 8b94241c050000 }
            // n = 7, score = 100
            //   8b842418050000       | mov                 eax, dword ptr [esp + 0x518]
            //   89d3                 | mov                 ebx, edx
            //   89bc24d0010000       | mov                 dword ptr [esp + 0x1d0], edi
            //   31d5                 | xor                 ebp, edx
            //   8b7c2460             | mov                 edi, dword ptr [esp + 0x60]
            //   89ac24d4010000       | mov                 dword ptr [esp + 0x1d4], ebp
            //   8b94241c050000       | mov                 edx, dword ptr [esp + 0x51c]

        $sequence_3 = { 8b5d0c f7da 221433 09ca 83f801 88542430 0f8400110000 }
            // n = 7, score = 100
            //   8b5d0c               | mov                 ebx, dword ptr [ebp + 0xc]
            //   f7da                 | neg                 edx
            //   221433               | and                 dl, byte ptr [ebx + esi]
            //   09ca                 | or                  edx, ecx
            //   83f801               | cmp                 eax, 1
            //   88542430             | mov                 byte ptr [esp + 0x30], dl
            //   0f8400110000         | je                  0x1106

        $sequence_4 = { 741b 83fe06 740c c7470400000000 ba08000000 c7041700000000 83c204 }
            // n = 7, score = 100
            //   741b                 | je                  0x1d
            //   83fe06               | cmp                 esi, 6
            //   740c                 | je                  0xe
            //   c7470400000000       | mov                 dword ptr [edi + 4], 0
            //   ba08000000           | mov                 edx, 8
            //   c7041700000000       | mov                 dword ptr [edi + edx], 0
            //   83c204               | add                 edx, 4

        $sequence_5 = { 8b8c24d8010000 89ac24dc010000 8b9424dc010000 898c24e8030000 899424ec030000 8b03 8b6b04 }
            // n = 7, score = 100
            //   8b8c24d8010000       | mov                 ecx, dword ptr [esp + 0x1d8]
            //   89ac24dc010000       | mov                 dword ptr [esp + 0x1dc], ebp
            //   8b9424dc010000       | mov                 edx, dword ptr [esp + 0x1dc]
            //   898c24e8030000       | mov                 dword ptr [esp + 0x3e8], ecx
            //   899424ec030000       | mov                 dword ptr [esp + 0x3ec], edx
            //   8b03                 | mov                 eax, dword ptr [ebx]
            //   8b6b04               | mov                 ebp, dword ptr [ebx + 4]

        $sequence_6 = { 8b1c9584a34700 0fb6502b 897c2404 896c2410 c1e508 895c2414 c1e310 }
            // n = 7, score = 100
            //   8b1c9584a34700       | mov                 ebx, dword ptr [edx*4 + 0x47a384]
            //   0fb6502b             | movzx               edx, byte ptr [eax + 0x2b]
            //   897c2404             | mov                 dword ptr [esp + 4], edi
            //   896c2410             | mov                 dword ptr [esp + 0x10], ebp
            //   c1e508               | shl                 ebp, 8
            //   895c2414             | mov                 dword ptr [esp + 0x14], ebx
            //   c1e310               | shl                 ebx, 0x10

        $sequence_7 = { 8b5f40 85db 0f84a9000000 e8???????? 8954241c 89c1 bad34d6210 }
            // n = 7, score = 100
            //   8b5f40               | mov                 ebx, dword ptr [edi + 0x40]
            //   85db                 | test                ebx, ebx
            //   0f84a9000000         | je                  0xaf
            //   e8????????           |                     
            //   8954241c             | mov                 dword ptr [esp + 0x1c], edx
            //   89c1                 | mov                 ecx, eax
            //   bad34d6210           | mov                 edx, 0x10624dd3

        $sequence_8 = { 8bbc2404010000 21c3 898c2498000000 894d10 31df 89c3 89bc249c000000 }
            // n = 7, score = 100
            //   8bbc2404010000       | mov                 edi, dword ptr [esp + 0x104]
            //   21c3                 | and                 ebx, eax
            //   898c2498000000       | mov                 dword ptr [esp + 0x98], ecx
            //   894d10               | mov                 dword ptr [ebp + 0x10], ecx
            //   31df                 | xor                 edi, ebx
            //   89c3                 | mov                 ebx, eax
            //   89bc249c000000       | mov                 dword ptr [esp + 0x9c], edi

        $sequence_9 = { e8???????? e9???????? 83c205 e9???????? 89742404 891c24 bd07000000 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   e9????????           |                     
            //   83c205               | add                 edx, 5
            //   e9????????           |                     
            //   89742404             | mov                 dword ptr [esp + 4], esi
            //   891c24               | mov                 dword ptr [esp], ebx
            //   bd07000000           | mov                 ebp, 7

    condition:
        7 of them and filesize < 1425408
}
Download all Yara Rules