MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6edb794a9f28cbd60dcb9fefc0e145f64c9e623b3df235a4a907ca948fd1edb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6edb794a9f28cbd60dcb9fefc0e145f64c9e623b3df235a4a907ca948fd1edb9
SHA3-384 hash: 4299cf3a4b37cea993b12baf7a69dd5d302d17ee4429c08f912758a6f3f7979bcd4ba273c8b5cc80881233c04016ddc3
SHA1 hash: 39d86228750d1eebdb78f60b03c3b638acf72d34
MD5 hash: 618a1e3551560b86454450f3ea580029
humanhash: connecticut-ceiling-stream-wyoming
File name:618a1e3551560b86454450f3ea580029.exe
Download: download sample
File size:598'016 bytes
First seen:2020-06-30 12:04:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b95bd93e7d976a746434add8b2c20d20
ssdeep 6144:xtG+hqIcBrwg+Kc8R52HQCL8cvYgkaL4rxMLarbohOOJtWTzbIBvWv5UidT:x8+7c/+DAAHQCLxCK2ohOQWTAuZ
Threatray 64 similar samples on MalwareBazaar
TLSH D9D49F8AB9A390F7C63416B24BAB6735AA758E011B15CFC35378DE3E1D32580D93713A
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/17100/
Detection(s):
Win.Malware.Zusy-6840460-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6edb794a9f28cbd60dcb9fefc0e145f64c9e623b3df235a4a907ca948fd1edb9/
Threat name:
Win32.Trojan.BitCoinMiner
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 12:06:06 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
2e13c882d28c2236893a0a543e67c74a4f2e560d98c98b800f95c07938156a37
4926b96164fb60d873073e001df509423e2935bea931191f26a938ebc1425629
56133c0d017af35f49253926e3583cf72c36146ab7faa65b6058971685166652
7333ddf4a7e53eeda33a8360b307471358597aeff78f4a5a7f4610640f97bdc7
76b691202fbef6ff77ef70905b4795802839d92070c0c8a6b92a99b41ac7dd70
7722f9fc1c3104b305915e49413e86df71e233fc2ac2914eee60ab7a59fcdf14
799b7395c9f279d8cd1cd24657788ecb37db7ae03c0dddeb3344a95a551d1325
7e5b0829c6ff31260033e79d4172ef09efa4c6667a99c97b8ec82d614a68a241
870d16eb412c190d404ea3239d9d21339918f55dd3bfa92fe072a92cdfd30144
af86c7d38b436ded683e7a304f9200312aaa8e283c31de972bfabcd87a857a1b
+ 54 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence evasion miner
Link:
https://tria.ge/reports/200630-mw6ctwedfe/
Behaviour
Creates scheduled task(s)
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Launches sc.exe
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Modifies service
Identifies Wine through registry keys
Loads dropped DLL
Deletes itself
Executes dropped EXE
Creates new service(s)
Detected Stratum cryptominer command
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Modifies WinLogon for persistence
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CN_Honker_WordpressScanner
Create hunting rule
Author:Florian Roth
Description:Sample from CN Honker Pentest Toolset - file WordpressScanner.exe
Reference:Disclosed CN Honker Pentest Toolset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 6edb794a9f28cbd60dcb9fefc0e145f64c9e623b3df235a4a907ca948fd1edb9

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/17100/
  
URLhaus
https://urlhaus.abuse.ch/url/226586/
  
Delivery method
Distributed via web download

Comments