MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48b9908bc98ae2903ee34167224b402fe5eb3a6c9b853ab17e728de52e2639a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 3


Intelligence 3 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48b9908bc98ae2903ee34167224b402fe5eb3a6c9b853ab17e728de52e2639a0
SHA3-384 hash: a9eaa9ab9e12840678ca093555f8a581208d8dc60c87dfcd8a4fba4986b8986d6fa80c579732f03404b3e3ddd58f577c
SHA1 hash: 812a8a2a420c2947ddddbb8a0f3ce15ce5ac1bfd
MD5 hash: d247c67f780003dd9e82b11eceeb3cba
humanhash: tennessee-yellow-sodium-william
File name:48b9908bc98ae2903ee34167224b402fe5eb3a6c9b853ab17e728de52e2639a0
Download: download sample
Signature CoinMiner
Create hunting rule
File size:16'861'578 bytes
First seen:2020-06-03 09:29:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 41d4c56009e4f7c74b5cb4a5919d9f05 (7 x CoinMiner, 1 x Adware.Generic)
ssdeep 196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1
Threatray 64 similar samples on MalwareBazaar
TLSH 3B070222B65084B1D1CA017055FB5B37AAB976190B24F5CFB79CCD6A2F32390EE36319
Reporter raashidbhatt
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-48
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

Win.Exploit.EQGRP-6322722-0
Create hunting rule

Win.Dropper.Gh0stRAT-6989861-0
Create hunting rule

Win.Dropper.Gh0stRAT-6991075-0
Create hunting rule

Win.Exploit.ChinaChopper-1-7122825-1
Create hunting rule

PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Malware.Generic-6718284-0
Create hunting rule

PUA.Win.Adware.Hpdefender-6725853-0
Create hunting rule

Win.Exploit.EQGRP-6322721-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Equationdrug
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 17:20:34 UTC
AV detection:
40 of 48 (83.33%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
071c9ef8d382452d6bcaa4a46eeb4a0e71562097201d228caf15229fd2b68ac9
CoinMiner
0f1f333f34d4ab91907ca6a0ad8d3360d5324623e9c885ab228127bce34932e5
CoinMiner
2a214959e1a85a4d11444053d4262961ee29e2cc53c3f4ae8f1a59152e5d67f3
CoinMiner
3b6888d30e34ab5f977345c962d76f352483f6138a89079061839af1f553ca18
CoinMiner
82385c5627675bb1a2f760238c766d1b8d3c31e109e067334959c084d62e5d55
CoinMiner
8f327b1ce9510b718d832e0d0d38caf1aa73c3af31f6a915442f5b90015e7e6e
CoinMiner
bd668ef292ae01d2ed9a32b1ea054e2acb484f61e86481f306669637ba31ce82
CoinMiner
e162d29d0ba895e3ea7d75000c41c843225c7d29147b323ed9a72f4de3c1f6f0
CoinMiner
f309d3820c2f40109825f3ebf2e00f84f0eb8d97e3b78cc74e751b69ba738435
CoinMiner
fde7c52c166cd76fea454bbb539e7eba9ce704f5b442534bf5c4163213215426
CoinMiner
+ 54 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery evasion persistence upx
Link:
https://tria.ge/reports/201109-z4gqclg5b2/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Modifies registry class
Runs net.exe
Runs ping.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
NSIS installer
Launches sc.exe
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Modifies service
Checks installed software on the system
JavaScript code in executable
Looks up external IP address via web service
Loads dropped DLL
Drops file in Drivers directory
Executes dropped EXE
Modifies Windows Firewall
Sets file execution options in registry
UPX packed file
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT32_KerrDown
Create hunting rule
Rule name:ccrewQAZ
Create hunting rule
Author:AlienVault Labs
Rule name:Choice_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Datper
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Datper in memory
Reference:https://blogs.jpcert.or.jp/en/2017/08/detecting-datper-malware-from-proxy-logs.html
Rule name:Embedded_PE
Create hunting rule
Rule name:IceID_Bank_trojan
Create hunting rule
Author:unixfreaxjp
Description:Detects IcedID..adjusted several times
Rule name:MAL_XMR_Miner_May19_1
Create hunting rule
Author:Florian Roth
Description:Detects Monero Crypto Coin Miner
Reference:https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Rule name:mimikatz
Create hunting rule
Author:Benjamin DELPY (gentilkiwi)
Description:mimikatz
Rule name:Mimikatz_Strings
Create hunting rule
Author:Florian Roth
Description:Detects Mimikatz strings
Reference:not set
Rule name:MINER_monero_mining_detection
Create hunting rule
Author:Christiaan Beek | McAfee ATR Team
Description:Monero mining software
Rule name:Ping_Command_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an suspicious ping command execution in an executable
Reference:Internal Research
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_mimikatz_w0
Create hunting rule
Author:Benjamin DELPY (gentilkiwi)
Description:mimikatz
Rule name:win_younglotus_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:XMRIG_Miner
Create hunting rule
Rule name:XMRIG_Monero_Miner
Create hunting rule
Author:Florian Roth
Description:Detects Monero mining software
Reference:https://github.com/xmrig/xmrig/releases

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments