MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 16


Intelligence 16 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
SHA3-384 hash: de12ba9545af77c04bf1aaed98ceaac9d6f2234ab39d5b886a17cedebc549b02f64e65bce189ba3030e85047a748da11
SHA1 hash: 27aa1ad8dbe7040e9ba2a1499ef4ce0117728f6d
MD5 hash: f6814a59c53218b84eb943ef07fcb74c
humanhash: ack-fourteen-papa-oven
File name:SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518
Download: download sample
Signature CoinMiner
Create hunting rule
File size:3'947'465 bytes
First seen:2024-10-29 21:31:47 UTC
Last seen:2024-10-29 21:31:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a1496c94d52a035fe47259ee6587b7 (5 x RemoteManipulator, 2 x CoinMiner, 1 x WSHRAT)
ssdeep 98304:fyzs10ZzmBarm735MyHkWKA7kFCQi7MahHr5Gt40JY8:fyQfBamD5QM7Mms4ah
Threatray 67 similar samples on MalwareBazaar
TLSH T1D606331E73A1C5F6E933803AC8468A56F2F938151775CB9E07695A1F3F33260AE29731
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter SecuriteInfoCom
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
448
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://k2ygoods.top/m.dat
Verdict:
No threats detected
Analysis date:
2023-09-24 18:09:32 UTC
Tags:
loader
Link:
https://app.any.run/tasks/aae3a06f-c1c1-421e-b363-c6f7e2ea679a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Siggen29.1091.12323.28137.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67215458a75e41aa6722d73e
Tags:
Powershell Xmrig
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Creating a service
Launching a process
Creating a file
Launching a service
Enabling the 'hidden' option for recently created files
Launching the process to change the firewall settings
DNS request
Connection attempt
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Creating a file in the system32 subdirectories
Sending a custom TCP request
Enabling autorun for a service
Downloading the file
Blocking the Windows Defender launch
Forced shutdown of a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug attrib botnet byovd coinminer crypto fingerprint installer lolbin lsass.exe microsoft_visual_cc miner monero netsh obfuscated overlay packed packed packed packer_detected pup rijndael setupapi sfx shdocvw shell32 whirlpool xmrig
Link:
https://www.filescan.io/uploads/672154572734cb737d8fd874/reports/73a57167-7485-45e8-ab0b-6fad49fda7b9/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
XMRig Miner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b1d3d255-7d59-48f8-b5fd-99a0b560cbeb
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1544963
Signature
AI detected suspicious sample
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Found strings related to Crypto-Mining
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sigma detected: Execution from Suspicious Folder
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: Powershell Download and Execute IEX
Sigma detected: PowerShell Download and Execution Cradles
Sigma detected: Suspicious Process Parents
Sigma detected: System File Execution Location Anomaly
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Uses cmd line tools excessively to alter registry or file data
Uses netsh to modify the Windows network and firewall settings
Uses regedit.exe to modify the Windows registry
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1544963 Sample: SecuriteInfo.com.Trojan.Sig... Startdate: 29/10/2024 Architecture: WINDOWS Score: 100 66 time.windows.com 2->66 68 k2ygoods.ydns.eu 2->68 70 2 other IPs or domains 2->70 88 Suricata IDS alerts for network traffic 2->88 90 Malicious sample detected (through community Yara rule) 2->90 92 Antivirus detection for dropped file 2->92 94 14 other signatures 2->94 10 SecuriteInfo.com.Trojan.Siggen29.1091.20762.15518.exe 3 15 2->10         started        14 1sass.exe 1 2->14         started        16 lsass.exe 2 1 2->16         started        18 8 other processes 2->18 signatures3 process4 file5 58 C:\Windows\debug\m\winlogon.exe, PE32+ 10->58 dropped 60 C:\Windows\debug\m\csrss.exe, PE32+ 10->60 dropped 62 C:\Windows\debug\m\WinRing0x64.sys, PE32+ 10->62 dropped 64 2 other files (1 malicious) 10->64 dropped 110 Found strings related to Crypto-Mining 10->110 112 Sample is not signed and drops a device driver 10->112 114 Drops PE files with benign system names 10->114 20 wscript.exe 1 10->20         started        23 csrss.exe 1 14->23         started        25 conhost.exe 14->25         started        116 Drops executables to the windows directory (C:\Windows) and starts them 16->116 27 winlogon.exe 1 16->27         started        30 conhost.exe 16->30         started        118 Query firmware table information (likely to detect VMs) 18->118 120 Changes security center settings (notifications, updates, antivirus, firewall) 18->120 signatures6 process7 dnsIp8 96 Wscript starts Powershell (via cmd or directly) 20->96 98 Windows Scripting host queries suspicious COM object (likely to drop second stage) 20->98 32 cmd.exe 4 20->32         started        100 Antivirus detection for dropped file 23->100 102 Multi AV Scanner detection for dropped file 23->102 104 Potentially malicious time measurement code found 23->104 36 cmd.exe 1 23->36         started        72 152.70.236.119, 443, 49978, 49980 ZENEDGEUS United States 27->72 74 43.201.71.88, 443, 49712, 49979 LILLY-ASUS Japan 27->74 76 k2yisgood.top 45.89.228.144, 443, 49700, 49831 ASBAXETNRU Russian Federation 27->76 106 Query firmware table information (likely to detect VMs) 27->106 108 Machine Learning detection for dropped file 27->108 signatures9 process10 file11 54 C:\PerfLogs\Admin\csrss.exe, PE32+ 32->54 dropped 56 C:\PerfLogs\Admin\1sass.exe, PE32+ 32->56 dropped 80 Suspicious powershell command line found 32->80 82 Wscript starts Powershell (via cmd or directly) 32->82 84 Uses cmd line tools excessively to alter registry or file data 32->84 86 5 other signatures 32->86 38 netsh.exe 2 32->38         started        40 conhost.exe 32->40         started        42 regedit.exe 1 32->42         started        48 9 other processes 32->48 44 powershell.exe 14 25 36->44         started        signatures12 process13 dnsIp14 78 k2ygoods.ydns.eu 46.29.162.246, 49739, 80 ASBAXETNRU Russian Federation 44->78 122 Uses cmd line tools excessively to alter registry or file data 44->122 124 Loading BitLocker PowerShell Module 44->124 50 WmiPrvSE.exe 44->50         started        52 reg.exe 44->52         started        signatures15 process16
Score:
90%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077/
Threat name:
Win64.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-09-03 13:27:02 UTC
File Type:
PE+ (Exe)
Extracted files:
35
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y7vp7hltlwho6qwhhpsmbe7xwmoppug7ddey2e26xek4cnaj2b3q._file
Verdict:
malicious
Label(s):
admintool_nssm
Create hunting rule
Similar samples:
0c1a1f2e3dbff28245bd06a7b923751f18c289e1dee7e8c5ea8b375a0a085caa
CoinMiner
21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
CoinMiner
2c8ea0f991d74146f056e4ed453e92ad1798daf2878f5520f54cf3d70d607613
CoinMiner
4bc8c57bc1c743b7607ba2e15670591551241fd3b129c266c5894159e72d1c72
CoinMiner
772dab859fd099f0c1373b3fb4fec7aaca42ed71daabe1d1a413e3c66cc4f14d
CoinMiner
7f8875c429f32788547639c9bbe36793b2d565de181dc1ccc07404345ef52253
CoinMiner
826fb62aa2659c50864af07f2cd840e15310043a138f8ced0872e7d9a9fcdb4b
CoinMiner
error
CoinMiner
f119182c1c9b0a6fe11b9d127681de6b0093397833f7d23bf3526b68249afc24
CoinMiner
f6f7f3647e865740ab06d24f66219a519f2b60572d424deb9273e919222d9376
CoinMiner
+ 57 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig evasion execution miner persistence privilege_escalation
Link:
https://tria.ge/reports/241029-1dl2cszfmd/
Behaviour
Modifies data under HKEY_USERS
Modifies registry class
Runs .reg file with regedit
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Modifies Windows Firewall
Sets file to hidden
Stops running service(s)
XMRig Miner payload
Xmrig family
xmrig
Malware Config
Dropper Extraction:
http://k2ygoods.ydns.eu/power.txt
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b7f79f98-2ef0-4819-b615-b3fe80753b01
Unpacked files
SH256 hash:
8d70b99cd76de4f8a019654bde6fc2c465d6340830d2b394177fba755440a6c2
MD5 hash:
bc59c52a71f212985286c1e27220b99f
SHA1 hash:
30cef45a02b599bef0ebe22c708274eb2d61f320
Detections:
XMRig
Create hunting rule
MALWARE_Win_CoinMiner02
Create hunting rule
XMRIG_Monero_Miner
Create hunting rule
MAL_XMR_Miner_May19_1
Create hunting rule
Link:
https://www.unpac.me/results/04ff04ef-05a7-47ad-b874-4a5a030af1af/
Parent samples :
21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
SH256 hash:
1b019e434a871b799def0d148101719f889f49c5ef169291ea766705760f649a
MD5 hash:
fb0577a1c32ba19ade1f5cc23b755fe1
SHA1 hash:
ce0e8ea9dfccdb110facd4875c7fc80bc80849c0
Detections:
Suspicious_PowerShell_WebDownload_1
Create hunting rule
Link:
https://www.unpac.me/results/04ff04ef-05a7-47ad-b874-4a5a030af1af/
Parent samples :
21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
SH256 hash:
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 hash:
0c0195c48b6b8582fa6f6373032118da
SHA1 hash:
d25340ae8e92a6d29f599fef426a2bc1b5217299
Detections:
PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD
Create hunting rule
Link:
https://www.unpac.me/results/04ff04ef-05a7-47ad-b874-4a5a030af1af/
Parent samples :
efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8
40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779
e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6
e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0
01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83
f49dd9baed6ec113ad16bcd07e50ab5dc1ca98ef4797712cbf3f2f5463a16d41
22289a61cd8a347a03da845d34820534b3e617781447a91c6a0fb3b1e6f6a184
21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
235c665b25c1e78fed3ca96e57c374e5a416aad1d27b4ae436a1c6c58604268b
c8a83c6c8f797e36eb7a5edf0e5f85a8d985895c82932422b95bf628f4106dfb
ed3ce2006fbfa402977bb026324637b905c5cc8228254b88037d3f68152463d3
a7a9d6a874f65ea3689930a2af208a025fee0a3dc1ad5cb9c964cbadd2cacf1f
67bf6d0a4de17f79de1347b75c9d1af3106448a806132cf50b38c2c8aa19d8ea
254a713d3ec2852b6657ecb8840efd2662e048ace42c2b4e0b30c589cdb9f8cb
6353b1218561a746bb3e009b611a1945bc2367b4d3ffef7849d4af4d369f184c
4f85b6d87dcc12f7904f95f3716b18930c63cb18bd624c1abcbdd9181ba4efc2
e93433169e2ec088a21ee58ae3e780f68215eb75dcd31b83d1fa31d6c16145e5
SH256 hash:
c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
MD5 hash:
f6814a59c53218b84eb943ef07fcb74c
SHA1 hash:
27aa1ad8dbe7040e9ba2a1499ef4ce0117728f6d
Link:
https://www.unpac.me/results/04ff04ef-05a7-47ad-b874-4a5a030af1af/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3265232/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdiplusShutdown
gdiplus.dll::GdipAlloc
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::AttachConsole
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::FreeConsole
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW

Comments