MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1
SHA3-384 hash: 121dae91cc8b7013a35746b622a9a69b58d3d1485c3a92b2d2e1251a08c0c7cd2ab90d4ab7af2b40f9754b92de089d34
SHA1 hash: 7473bb65f0e44277f87c910573bc8170279ed671
MD5 hash: ae086d0d666c0baa7c2018227c213023
humanhash: oven-romeo-thirteen-dakota
File name:e424e9bbd3853459d205936d047a3bd08529ffb857dcc47a279e5c2c9fa820f1
Download: download sample
File size:9'320'025 bytes
First seen:2020-06-03 09:37:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash aa87db00eff03dc11398f903a07cd843 (1 x CoinMiner)
ssdeep 196608:Ta9+6Y7SOEibgR1scJYyzPpCLir23+mK:TFgRWdyzPpehK
Threatray 622 similar samples on MalwareBazaar
TLSH CC96AD12B7D24036E1B712B189B79739AA35BD2007318ADF73846B2E6E327D19E31357
Reporter raashidbhatt
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CoinMiner-24.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.Tool.BtcMine-2.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Packer.PrivateExeProte-16
Create hunting rule

PUA.Win.Packer.AcprotectUltraprotect-1
Create hunting rule

Win.Virus.Triusor-6913348-0
Create hunting rule

Win.Malware.Score-6940809-0
Create hunting rule

Win.Malware.Score-6940810-0
Create hunting rule

Win.Coinminer.Generic-7104546-0
Create hunting rule

Win.Coinminer.Generic-7151253-0
Create hunting rule

Win.Coinminer.Generic-7151447-0
Create hunting rule

Win.Coinminer.Generic-7151481-0
Create hunting rule

Win.Coinminer.Generic-7151516-0
Create hunting rule

Win.Coinminer.Generic-7152522-0
Create hunting rule

Win.Coinminer.Generic-7155777-0
Create hunting rule

PUA.Win.File.Coinminer-7358301-0
Create hunting rule

Multios.Trojan.CryptocoinMiner-6448864-1
Create hunting rule

Multios.Coinminer.Miner-6781728-2
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Coinminer
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 17:16:33 UTC
AV detection:
45 of 48 (93.75%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
024a7ee33fb7e998cde95a0d0e4850022a8742e16544f8b1b32baf4b64644643
3611be7ee60f1adb4a14f2d5d307d7375fb8a9013d0ae24af5e639bcc524a595
3a7aeb8afd9e1bdb9e8d83cea2b3d4a981be1ea951c46e48cf6c96a9852d1d14
5d31ded12c6a8943f96522d5353af0d3bbb9a5ee81cef07db1c14c7cc0f117c6
7e118b534abb919903bc15b33f5fe2db15a54f7f39a7abc87c61e4617f35c0d2
7fb688f33ebc7b9c193aa87c8638f78e93511354a187822e7d06c1668f30da82
9b6c23ee51101f9e2542bb697e7b218e0a57d51ac6b577998cba351581aa7491
9b6c4134cedbba1e6300d315e64b17b645151f7c2e15ac54f4a9fa1e8aefa48b
c54495e55e1b18bea4e6e36ab10dadb115db761a4255f7379f268eb9e28e96d4
cd327c510c630f47d64c6e7bde422574480f57f6c455d41a2b0c7072e43779f7
+ 612 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence spyware trojan upx
Link:
https://tria.ge/reports/201109-n18wekdkma/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Modifies registry class
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Checks whether UAC is enabled
JavaScript code in executable
Reads user/profile data of web browsers
Checks computer location settings
Executes dropped EXE
Sets file execution options in registry
UAC bypass
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments