MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 17


Intelligence 17 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
SHA3-384 hash: 022d90f8624b4704f621382f4efe9d6fbd0a4a643ce12c8b57366ec820ae6fdb7b71465002182e467d3108f4549eae39
SHA1 hash: 16364eaf46e7bb534711c08153f2d15df3a98152
MD5 hash: 9f764608bb066354b8c39e3c8ac55596
humanhash: indigo-bacon-apart-winter
File name:SecuriteInfo.com.Trojan.Siggen29.1091.19313.13427
Download: download sample
Signature CoinMiner
Create hunting rule
File size:3'947'462 bytes
First seen:2024-10-17 17:18:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a1496c94d52a035fe47259ee6587b7 (5 x RemoteManipulator, 2 x CoinMiner, 1 x WSHRAT)
ssdeep 98304:fyvs10ZzmBarm735MyHkWKA7kFCQi7MahHr5Gt40JY8:fykfBamD5QM7Mms4ah
Threatray 67 similar samples on MalwareBazaar
TLSH T17606331E73A1C5F6E933803AC8468656F2F938161775CB9E07695A1F3F33260AE29731
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter SecuriteInfoCom
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
397
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://google.com
Verdict:
Malicious activity
Analysis date:
2023-09-20 08:45:17 UTC
Tags:
loader
Link:
https://app.any.run/tasks/dc772159-a4dc-4faa-9e72-81c1026d1973

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Siggen29.1091.19313.13427.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6711470a34f884d15c8c67aa
Tags:
Powershell Xmrig
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug attrib botnet byovd coinminer crypto fingerprint installer lolbin lsass.exe microsoft_visual_cc miner monero netsh obfuscated overlay packed packed pup rijndael setupapi sfx shdocvw shell32 whirlpool xmrig
Link:
https://www.filescan.io/uploads/67114708b8693873ac8348f1/reports/28b81e6b-fee5-43f8-8e4e-10806a5c4465/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
Result
Verdict:
MALICIOUS
Malware family:
XMRig Miner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6bbcc151-c33f-463a-85b6-eee1177cb9bb
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1536297
Signature
AI detected suspicious sample
Antivirus detection for dropped file
Blacklisted process start detected (Windows program)
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Found strings related to Crypto-Mining
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sigma detected: Execution from Suspicious Folder
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: Powershell Download and Execute IEX
Sigma detected: PowerShell Download and Execution Cradles
Sigma detected: Suspicious Process Parents
Sigma detected: System File Execution Location Anomaly
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Uses cmd line tools excessively to alter registry or file data
Uses netsh to modify the Windows network and firewall settings
Uses regedit.exe to modify the Windows registry
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1536297 Sample: SecuriteInfo.com.Trojan.Sig... Startdate: 17/10/2024 Architecture: WINDOWS Score: 100 64 k2ygoods.ydns.eu 2->64 66 k2ygoods.top 2->66 68 k2yisgood.top 2->68 92 Suricata IDS alerts for network traffic 2->92 94 Malicious sample detected (through community Yara rule) 2->94 96 Antivirus detection for dropped file 2->96 98 15 other signatures 2->98 10 SecuriteInfo.com.Trojan.Siggen29.1091.19313.13427.exe 3 15 2->10         started        14 1sass.exe 1 2->14         started        16 lsass.exe 2 1 2->16         started        signatures3 process4 file5 52 C:\Windows\debug\m\winlogon.exe, PE32+ 10->52 dropped 54 C:\Windows\debug\m\csrss.exe, PE32+ 10->54 dropped 56 C:\Windows\debug\m\WinRing0x64.sys, PE32+ 10->56 dropped 58 2 other files (1 malicious) 10->58 dropped 108 Found strings related to Crypto-Mining 10->108 110 Sample is not signed and drops a device driver 10->110 112 Drops PE files with benign system names 10->112 18 wscript.exe 1 10->18         started        21 csrss.exe 1 14->21         started        23 conhost.exe 14->23         started        114 Drops executables to the windows directory (C:\Windows) and starts them 16->114 25 winlogon.exe 1 16->25         started        28 conhost.exe 16->28         started        signatures6 process7 dnsIp8 78 Wscript starts Powershell (via cmd or directly) 18->78 80 Windows Scripting host queries suspicious COM object (likely to drop second stage) 18->80 30 cmd.exe 4 18->30         started        82 Antivirus detection for dropped file 21->82 84 Multi AV Scanner detection for dropped file 21->84 86 Potentially malicious time measurement code found 21->86 34 cmd.exe 1 21->34         started        70 k2yisgood.top 152.70.236.119, 443, 49782, 49838 ZENEDGEUS United States 25->70 72 43.201.71.88, 443, 49704 LILLY-ASUS Japan 25->72 74 45.89.228.144, 443, 49983, 49987 ASBAXETNRU Russian Federation 25->74 88 Query firmware table information (likely to detect VMs) 25->88 90 Machine Learning detection for dropped file 25->90 signatures9 process10 file11 60 C:\PerfLogs\Admin\csrss.exe, PE32+ 30->60 dropped 62 C:\PerfLogs\Admin\1sass.exe, PE32+ 30->62 dropped 116 Uses cmd line tools excessively to alter registry or file data 30->116 118 Drops executables to the windows directory (C:\Windows) and starts them 30->118 120 Uses regedit.exe to modify the Windows registry 30->120 126 3 other signatures 30->126 36 regedit.exe 1 30->36         started        39 lsass.exe 4 1 30->39         started        41 netsh.exe 2 30->41         started        46 9 other processes 30->46 122 Suspicious powershell command line found 34->122 124 Wscript starts Powershell (via cmd or directly) 34->124 43 powershell.exe 14 25 34->43         started        signatures12 process13 dnsIp14 100 Blacklisted process start detected (Windows program) 36->100 102 Suspicious powershell command line found 39->102 76 k2ygoods.top 46.29.162.246, 49716, 49738, 80 ASBAXETNRU Russian Federation 43->76 104 Uses cmd line tools excessively to alter registry or file data 43->104 106 Loading BitLocker PowerShell Module 43->106 48 WmiPrvSE.exe 43->48         started        50 reg.exe 43->50         started        signatures15 process16
Score:
90%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7/
Threat name:
Win64.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-09-03 13:34:19 UTC
File Type:
PE+ (Exe)
Extracted files:
35
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=efuqu4lpjvhtv45nabie37kb55grdjlgh74wym3fqoejn76k5xlq._file
Verdict:
malicious
Label(s):
admintool_nssm
Create hunting rule
Similar samples:
0c1a1f2e3dbff28245bd06a7b923751f18c289e1dee7e8c5ea8b375a0a085caa
CoinMiner
2c8ea0f991d74146f056e4ed453e92ad1798daf2878f5520f54cf3d70d607613
CoinMiner
4b0b811922ef54485f8bb75aaadeedf70f173d56d958d5b980b8abcaaefb6540
CoinMiner
772dab859fd099f0c1373b3fb4fec7aaca42ed71daabe1d1a413e3c66cc4f14d
CoinMiner
7f8875c429f32788547639c9bbe36793b2d565de181dc1ccc07404345ef52253
CoinMiner
826fb62aa2659c50864af07f2cd840e15310043a138f8ced0872e7d9a9fcdb4b
CoinMiner
c605c90af10dbc8033e7f4d9aa6f999583a419d699907a14d8d72d08ffdb9e4c
CoinMiner
error
CoinMiner
f119182c1c9b0a6fe11b9d127681de6b0093397833f7d23bf3526b68249afc24
CoinMiner
f6f7f3647e865740ab06d24f66219a519f2b60572d424deb9273e919222d9376
CoinMiner
+ 57 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig evasion execution miner persistence privilege_escalation
Link:
https://tria.ge/reports/241017-vvtjwawemg/
Behaviour
Modifies data under HKEY_USERS
Modifies registry class
Runs .reg file with regedit
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Modifies Windows Firewall
Sets file to hidden
Stops running service(s)
XMRig Miner payload
xmrig
Malware Config
Dropper Extraction:
http://k2ygoods.ydns.eu/power.txt
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ff55dddc-2132-4345-b6f9-8304e8cf7674
Unpacked files
SH256 hash:
8d70b99cd76de4f8a019654bde6fc2c465d6340830d2b394177fba755440a6c2
MD5 hash:
bc59c52a71f212985286c1e27220b99f
SHA1 hash:
30cef45a02b599bef0ebe22c708274eb2d61f320
Detections:
XMRig
Create hunting rule
MALWARE_Win_CoinMiner02
Create hunting rule
XMRIG_Monero_Miner
Create hunting rule
MAL_XMR_Miner_May19_1
Create hunting rule
Link:
https://www.unpac.me/results/ca70baa7-97b3-431a-9e56-dd6ad765d01d/
Parent samples :
21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
SH256 hash:
1b019e434a871b799def0d148101719f889f49c5ef169291ea766705760f649a
MD5 hash:
fb0577a1c32ba19ade1f5cc23b755fe1
SHA1 hash:
ce0e8ea9dfccdb110facd4875c7fc80bc80849c0
Detections:
Suspicious_PowerShell_WebDownload_1
Create hunting rule
Link:
https://www.unpac.me/results/ca70baa7-97b3-431a-9e56-dd6ad765d01d/
Parent samples :
21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
SH256 hash:
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 hash:
0c0195c48b6b8582fa6f6373032118da
SHA1 hash:
d25340ae8e92a6d29f599fef426a2bc1b5217299
Detections:
PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD
Create hunting rule
Link:
https://www.unpac.me/results/ca70baa7-97b3-431a-9e56-dd6ad765d01d/
Parent samples :
efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8
40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779
e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6
e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0
01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83
f49dd9baed6ec113ad16bcd07e50ab5dc1ca98ef4797712cbf3f2f5463a16d41
22289a61cd8a347a03da845d34820534b3e617781447a91c6a0fb3b1e6f6a184
21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
235c665b25c1e78fed3ca96e57c374e5a416aad1d27b4ae436a1c6c58604268b
c8a83c6c8f797e36eb7a5edf0e5f85a8d985895c82932422b95bf628f4106dfb
ed3ce2006fbfa402977bb026324637b905c5cc8228254b88037d3f68152463d3
a7a9d6a874f65ea3689930a2af208a025fee0a3dc1ad5cb9c964cbadd2cacf1f
67bf6d0a4de17f79de1347b75c9d1af3106448a806132cf50b38c2c8aa19d8ea
254a713d3ec2852b6657ecb8840efd2662e048ace42c2b4e0b30c589cdb9f8cb
6353b1218561a746bb3e009b611a1945bc2367b4d3ffef7849d4af4d369f184c
4f85b6d87dcc12f7904f95f3716b18930c63cb18bd624c1abcbdd9181ba4efc2
e93433169e2ec088a21ee58ae3e780f68215eb75dcd31b83d1fa31d6c16145e5
SH256 hash:
21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
MD5 hash:
9f764608bb066354b8c39e3c8ac55596
SHA1 hash:
16364eaf46e7bb534711c08153f2d15df3a98152
Link:
https://www.unpac.me/results/ca70baa7-97b3-431a-9e56-dd6ad765d01d/
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/21690a716f4d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3239551/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdiplusShutdown
gdiplus.dll::GdipAlloc
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::AttachConsole
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::FreeConsole
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW

Comments