MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7b998957afba18e7f9c27b67692f1b26073250a6cf4187ad578e21925d16018. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 12

Intelligence 12 IOCs YARA 4 File information Comments

SHA256 hash:	d7b998957afba18e7f9c27b67692f1b26073250a6cf4187ad578e21925d16018
SHA3-384 hash:	8cae7379fc4f5de216d23fdbd6d0592716d9ab1952eeb98dad446b84321e6d9a5dffc2606308710dd5842e5b274a30ba
SHA1 hash:	066783e092007d2bcd10e2bbf412269fb9260d3f
MD5 hash:	90f9e1fdec81ccf508fc58f3d23156b5
humanhash:	sodium-stream-single-ten
File name:	xmrig64.exe
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	7'080'448 bytes
First seen:	2021-12-20 01:49:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	79fb66d6921c1c966cb5721dcba20ebf (1 x CoinMiner)
ssdeep	98304:OLbMr+zf/4kViIYVidkLWDHinLtOP4eJ6FOTYv2l+98yjaGxFYFheR6s3RulsN4n:OpEOPPTdSTBulsNAGAlP
Threatray	38 similar samples on MalwareBazaar
TLSH	T162665B17F29354ECC67AC170872BA772F631F86941307D7B2764DB342E62EA0562EB24
dhash icon	f8e4b4d959d6c678 (33 x CoinMiner)
Reporter	Abjuri5t
Tags:	CoinMiner exe log4j

Intelligence

File Origin

# of uploads :

# of downloads :

217

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

c71ca967560311967d8fb07ff2e24fcd

Verdict:

Malicious activity

Analysis date:

2020-12-21 07:00:44 UTC

Tags:

miner

Link:

https://app.any.run/tasks/8403003b-9178-4ca8-96e7-c594f33e2876

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

CoinMiner02

Link:

https://www.capesandbox.com/analysis/215294/

Detection(s):

Win.Coinminer.Generic-7151250-0

Win.Coinminer.Generic-7151253-0

Win.Coinminer.Generic-7151447-0

Win.Coinminer.Generic-7151972-0

Win.Coinminer.Generic-7155777-0

Win.Coinminer.Generic-7158858-0

Multios.Coinminer.Miner-6781728-2

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/2651/overview

Behaviour

MalwareBazaar

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug coin coinminer greyware monero smac virus

Link:

https://www.filescan.io/uploads/61bfe1138991ba72b38db2f5/reports/75d30b8e-a9ed-4b84-8076-07ca82c342b5/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

XMRig Miner

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e0b91543-bb2f-44c7-9c9f-c1e0cb80062c

Result

Threat name:

Xmrig

Detection:

malicious

Classification:

mine

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/909956

Signature

Antivirus / Scanner detection for submitted sample

Found strings related to Crypto-Mining

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d7b998957afba18e7f9c27b67692f1b26073250a6cf4187ad578e21925d16018/

Threat name:

Win64.Coinminer.Malxmr

Status:

Malicious

First seen:

2020-12-02 11:41:33 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

33 of 43 (76.74%)

Threat level:

4/5

Verdict:

malicious

CoinMiner

49a326ef65fb6a7f8e778fb2104aa2708e38601348ddbc04e8cbd9117af0458a

CoinMiner

780b58f0b7718cdfbf733122b8e8a1fb490596951dd3ead4cdc2059d352d616a

CoinMiner

91dd3fa11964f4432bb43ee5f63580d53ba35dfdcfd5d8ec1b0e00f3f7b20258

CoinMiner

a519b94cbb4c14b6fb3397c3220851ebf960fffe4f82360dbd4493bad0d38747

CoinMiner

b96c79ff7e741638ee99fc0461688440276bdb9df395d5325915408efd174876

CoinMiner

e2f0a2043a3d8ae1e3b6c3f156a410544c2336108b244dd2f9b77f2f9ede0a56

CoinMiner

ed2a3e363a6e6b4e13df5e00779a1318a267376b4a7878df7b0b2e75907c747e

CoinMiner

ffd134c643a96d41f3e2e4cdbe7b7a5d2d3e0335921e49618d6b3f9ee896a948

CoinMiner

+ 28 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig miner

Link:

https://tria.ge/reports/211220-b8pnashcf7/

Unpacked files

SH256 hash:

d7b998957afba18e7f9c27b67692f1b26073250a6cf4187ad578e21925d16018

MD5 hash:

90f9e1fdec81ccf508fc58f3d23156b5

SHA1 hash:

066783e092007d2bcd10e2bbf412269fb9260d3f

Link:

https://www.unpac.me/results/ce4095b6-7022-4dee-bca9-216e9a274c6a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d7b998957afba18e7f9c27b67692f1b26073250a6cf4187ad578e21925d16018

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_CoinMiner02 Create hunting rule
Author:	ditekSHen
Description:	Detects coinmining malware

Rule name:	MAL_XMR_Miner_May19_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Monero Crypto Coin Miner
Reference:	https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

Rule name:	MAL_XMR_Miner_May19_1_RID2E1B Create hunting rule
Author:	Florian Roth
Description:	Detects Monero Crypto Coin Miner
Reference:	https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

Rule name:	rig_win64_xmrig_6_13_1_xmrig Create hunting rule
Author:	yarGen Rule Generator
Description:	rig_win64 - file xmrig.exe
Reference:	https://github.com/Neo23x0/yarGen