MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2773044442f1aa7b3dbfeeda44cf6e82ebdd4ca804409fc61f85e8b43be905a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2773044442f1aa7b3dbfeeda44cf6e82ebdd4ca804409fc61f85e8b43be905a2
SHA3-384 hash: 5aed502b8df6f4d79b100b74e2e8eb65bf51fa5cde05e40f800066946e496ea801bad762e38e1874bcad0e5d509001d3
SHA1 hash: f473ab2287518748a4e0d4761ab5432a0a9f4679
MD5 hash: 12139416b963c7b080108ed47b209583
humanhash: lamp-speaker-south-princess
File name:2773044442f1aa7b3dbfeeda44cf6e82ebdd4ca804409fc61f85e8b43be905a2
Download: download sample
File size:2'128'244 bytes
First seen:2020-06-10 07:32:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4290fa6afc89d56616f34ebbd0b1f2c (50 x CoinMiner)
ssdeep 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VqeWKae:NABI
Threatray 12 similar samples on MalwareBazaar
TLSH 9EA523275F0A5D3FDBB8A2BC783D1A4A13D1CA114001AAF197C3109E6B8CF6D255F96E
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Coinminer-7331384-0
Create hunting rule

Win.Trojan.Coinminer-7331970-0
Create hunting rule

Win.Trojan.Coinminer-7331971-0
Create hunting rule

Win.Trojan.Coinminer-7332650-0
Create hunting rule

Gathering data
Threat name:
Win64.Trojan.CoinMiner
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 18:25:02 UTC
File Type:
PE+ (Exe)
Extracted files:
5
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
071c9ef8d382452d6bcaa4a46eeb4a0e71562097201d228caf15229fd2b68ac9
236d6e4f54d48c58b4bba9edc610522a5ede3c44c26aa593b87a3ea99c137908
4ae56999b52479b1985ad4dc0234d26ac7954a4cf54255874f859f3cd91fc45d
5ec2a270a9b0e335fb6ecf9d313e02771acad023d7a1a6168a15297d1f80312d
a4bd1ce6832e9cfa0078b39e7dc035047ff593ff4f875fd19ed7ab54508fa7e4
b6d78e286f13f4583ffea8c5d597d402b00efeb4a3b36832be1f86a3ce5c1e03
b942960f1b5ead6933f527b95e87cfc994ddaffc910dca727f56b04706161544
dea877be3b8ceb7eb4cb1bb40895bc6886d3ccb0f2498e7b3c4257d726a7d896
fc24c66249ff1d20ea728a18dbfe87018e27e487a43eb1f09d4b642d9766dc51
fde7c52c166cd76fea454bbb539e7eba9ce704f5b442534bf5c4163213215426
+ 2 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201109-q96gyylsdj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Drops file in Windows directory
Loads dropped DLL
Executes dropped EXE
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments