MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 18

Intelligence 18 IOCs YARA 3 File information Comments

SHA256 hash:	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0
SHA3-384 hash:	2d6274bceda1cb7959d43d59164195323493cfa48bd262a433ad4fe16755263cbf06e0ab1255da26d47e3851f2ec919a
SHA1 hash:	6ed4d761bf163120bab0dd7ab578ee4ab8d5d80c
MD5 hash:	f0834f7f2daa415fb992d93f549bbfd0
humanhash:	vegan-sodium-hydrogen-speaker
File name:	sky.exe
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	3'127'305 bytes
First seen:	2024-06-12 18:11:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4cfda23baf1e2e983ddfeca47a5c755a (33 x RedLineStealer, 6 x Dridex, 5 x NetSupport)
ssdeep	49152:YKTiWztohDIZZYiOG2qPX4xRgPZcUAtijL+kOqxvDUuPBBVFJt6NGGTDVOXLyagx:YK+WJ6sDYI2qPX4fgPZcUAUjSkXvDUiC
Threatray	353 similar samples on MalwareBazaar
TLSH	T162E5333174A08033E113443587D4D7366879B9349A362A9EFF548A7D7F21EA2C267BB3
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	cdabae6fe6e7eaec (20 x Amadey, 9 x AurotunStealer, 8 x CoinMiner)
Reporter	sentotayam
Tags:	CoinMiner exe miner

Intelligence

File Origin

# of uploads :

# of downloads :

402

Origin country :

Vendor Threat Intelligence

Malware family:

xmrig

ID:

File name:

e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe

Verdict:

Malicious activity

Analysis date:

2024-06-12 18:14:06 UTC

Tags:

miner xmrig

Link:

https://app.any.run/tasks/726ddb39-6801-4656-ac53-4e68e41380aa

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.PWS.Stealer.24943.1502.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6669e521a2bce47be7d80795win7simulatehigh_evasion

Tags:

Banker Encryption Execution Generic Network Other Static Stealth Malware Dexter

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the Windows subdirectories

Running batch commands

Creating a process from a recently created file

Creating a service

Launching a process

Launching a service

Enabling the 'hidden' option for recently created files

Launching the process to change the firewall settings

DNS request

Connection attempt

Sending a custom TCP request

Loading a system driver

Enabling autorun for a service

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug byovd coinminer crypto epmicrosoft_visual_cc fingerprint installer lolbin microsoft_visual_cc miner monero netsh overlay packed pup sfx shell32 svchost.exe xmrig

Link:

https://www.filescan.io/uploads/6669e4fe9fd5f9d5920fa701/reports/40196a5c-6595-4b6a-aea0-fbe2c4a8f0e4/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

XMRig Miner

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cbc2e787-8a58-4e8f-9d18-54b752bff294

Result

Threat name:

Xmrig

Detection:

malicious

Classification:

troj.evad.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1456174

Signature

Antivirus detection for dropped file

Detected Stratum mining protocol

Drops executables to the windows directory (C:\Windows) and starts them

Drops PE files with benign system names

Found strings related to Crypto-Mining

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Modifies the windows firewall

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Suspect Svchost Activity

Sigma detected: System File Execution Location Anomaly

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Score:

90%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0/

Threat name:

Win32.Coinminer.BitCoinMiner

Status:

Malicious

First seen:

2024-05-04 12:51:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 38 (63.16%)

Threat level:

4/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4fgsbvniaudrs4sf7qvvh3x4nrnz32neekcxwn3egt352a2thpaa._file

Verdict:

malicious

CoinMiner

4cd8586d09ba9e97b4e50bb2d9d1e671a50bfe79bcd29ebf851ae6defc8d1768

CoinMiner

59b3af1a244a082219116ed9b496de99236b01ae42df75bf4211ed2b7069bc4b

CoinMiner

9462b76ac528bdec226b714ce6e8756fff28f33048897ed1e11ec73218e8d1e4

CoinMiner

a25add458dd5f3d5ea3b8464b19a9a9100a10d58e47f5f0c9e88bfc65052f241

CoinMiner

efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

CoinMiner

f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd

CoinMiner

+ 343 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig evasion miner

Link:

https://tria.ge/reports/240612-ws6l4avbne/

Behaviour

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Enumerates physical storage devices

Drops file in Windows directory

Launches sc.exe

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Modifies Windows Firewall

Sets file to hidden

XMRig Miner payload

xmrig

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/804af188-91c7-4f7b-b06d-607f0042538f

Unpacked files

SH256 hash:

d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4

MD5 hash:

e2fe87cc2c7dab8ca6516620dccd1381

SHA1 hash:

f714ec0448325435103519452610cf7aadf8bbba

Detections:

XMRig

MALWARE_Win_CoinMiner02

XMRIG_Monero_Miner

MAL_XMR_Miner_May19_1

Link:

https://www.unpac.me/results/1c208466-5671-479c-8b24-cd1165557ee7/

Parent samples :

e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6
e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0
01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83

SH256 hash:

11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

MD5 hash:

0c0195c48b6b8582fa6f6373032118da

SHA1 hash:

d25340ae8e92a6d29f599fef426a2bc1b5217299

Detections:

PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD

Link:

https://www.unpac.me/results/1c208466-5671-479c-8b24-cd1165557ee7/

Parent samples :

efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8
40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779
e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6
e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0
01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83
f49dd9baed6ec113ad16bcd07e50ab5dc1ca98ef4797712cbf3f2f5463a16d41
22289a61cd8a347a03da845d34820534b3e617781447a91c6a0fb3b1e6f6a184
21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
235c665b25c1e78fed3ca96e57c374e5a416aad1d27b4ae436a1c6c58604268b
c8a83c6c8f797e36eb7a5edf0e5f85a8d985895c82932422b95bf628f4106dfb
ed3ce2006fbfa402977bb026324637b905c5cc8228254b88037d3f68152463d3
a7a9d6a874f65ea3689930a2af208a025fee0a3dc1ad5cb9c964cbadd2cacf1f
67bf6d0a4de17f79de1347b75c9d1af3106448a806132cf50b38c2c8aa19d8ea
254a713d3ec2852b6657ecb8840efd2662e048ace42c2b4e0b30c589cdb9f8cb
6353b1218561a746bb3e009b611a1945bc2367b4d3ffef7849d4af4d369f184c
4f85b6d87dcc12f7904f95f3716b18930c63cb18bd624c1abcbdd9181ba4efc2
e93433169e2ec088a21ee58ae3e780f68215eb75dcd31b83d1fa31d6c16145e5

SH256 hash:

dae3f731a30641bc6edf0edae9773a95d1d17b9a1acf8634c04b42d7fd15f8f2

MD5 hash:

3d2624853d085de820fe777276cc84ea

SHA1 hash:

f671f64449f1ac66f5cd11766758585832812563

Link:

https://www.unpac.me/results/1c208466-5671-479c-8b24-cd1165557ee7/

SH256 hash:

e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0

MD5 hash:

f0834f7f2daa415fb992d93f549bbfd0

SHA1 hash:

6ed4d761bf163120bab0dd7ab578ee4ab8d5d80c

Link:

https://www.unpac.me/results/1c208466-5671-479c-8b24-cd1165557ee7/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

exe e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0

(this sample)

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::SetFileSecurityW
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExW SHELL32.dll::SHFileOperationW SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_API	Can Create Process and Threads	ADVAPI32.dll::OpenProcessToken KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineW KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::WriteConsoleA KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW KERNEL32.dll::CreateFileMappingW KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileA KERNEL32.dll::DeleteFileW
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::FindWindowExW USER32.dll::PeekMessageW USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample