MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fde7c52c166cd76fea454bbb539e7eba9ce704f5b442534bf5c4163213215426. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 3


Intelligence 3 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fde7c52c166cd76fea454bbb539e7eba9ce704f5b442534bf5c4163213215426
SHA3-384 hash: cf06f1574f780706fe226a0daa3385560af97198bd84097de5577c6c0707db72e0af36c7e866871715ca177d9c1325e2
SHA1 hash: 82d61f2bc10fda1339c04cc4dab197f4c65d2c0d
MD5 hash: fe65255cbcfa9a67e87eb8791ef9446d
humanhash: delaware-green-indigo-golf
File name:fde7c52c166cd76fea454bbb539e7eba9ce704f5b442534bf5c4163213215426
Download: download sample
Signature CoinMiner
Create hunting rule
File size:16'799'010 bytes
First seen:2020-06-03 09:32:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 41d4c56009e4f7c74b5cb4a5919d9f05 (7 x CoinMiner, 1 x Adware.Generic)
ssdeep 196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1
Threatray 64 similar samples on MalwareBazaar
TLSH 11070222B65084B1D1CA017055FB5B37AAB976190B24F5CFB79CCD6A2F32390EE36319
Reporter raashidbhatt
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-48
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

Win.Exploit.EQGRP-6322722-0
Create hunting rule

Win.Dropper.Gh0stRAT-6989861-0
Create hunting rule

Win.Dropper.Gh0stRAT-6991075-0
Create hunting rule

Win.Exploit.ChinaChopper-1-7122825-1
Create hunting rule

PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Malware.Generic-6718284-0
Create hunting rule

PUA.Win.Adware.Hpdefender-6725853-0
Create hunting rule

Win.Exploit.EQGRP-6322721-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Equationdrug
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 17:18:22 UTC
AV detection:
40 of 48 (83.33%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
071c9ef8d382452d6bcaa4a46eeb4a0e71562097201d228caf15229fd2b68ac9
CoinMiner
0f1f333f34d4ab91907ca6a0ad8d3360d5324623e9c885ab228127bce34932e5
CoinMiner
3b6888d30e34ab5f977345c962d76f352483f6138a89079061839af1f553ca18
CoinMiner
48b9908bc98ae2903ee34167224b402fe5eb3a6c9b853ab17e728de52e2639a0
CoinMiner
4eb372dc146535028ffa1c88b7a6f0c7ce3a462b9dd53e1f7acdb61545bdfeeb
CoinMiner
6ed0051747d0d5fbf4273b02e7267a257a82217c4b474117ea853014218b2b18
CoinMiner
8f327b1ce9510b718d832e0d0d38caf1aa73c3af31f6a915442f5b90015e7e6e
CoinMiner
ac1b332e6958c5b81be1b747c8a30172741514ed397952e01ad174be94f112a4
CoinMiner
e162d29d0ba895e3ea7d75000c41c843225c7d29147b323ed9a72f4de3c1f6f0
CoinMiner
f309d3820c2f40109825f3ebf2e00f84f0eb8d97e3b78cc74e751b69ba738435
CoinMiner
+ 54 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery evasion persistence upx
Link:
https://tria.ge/reports/201109-nt1b85lcsj/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Modifies registry class
Runs net.exe
Runs ping.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
NSIS installer
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Modifies service
Checks installed software on the system
JavaScript code in executable
Looks up external IP address via web service
Loads dropped DLL
Drops file in Drivers directory
Executes dropped EXE
Modifies Windows Firewall
Sets file execution options in registry
UPX packed file
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT32_KerrDown
Create hunting rule
Rule name:ccrewQAZ
Create hunting rule
Author:AlienVault Labs
Rule name:Choice_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Datper
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Datper in memory
Reference:https://blogs.jpcert.or.jp/en/2017/08/detecting-datper-malware-from-proxy-logs.html
Rule name:Embedded_PE
Create hunting rule
Rule name:IceID_Bank_trojan
Create hunting rule
Author:unixfreaxjp
Description:Detects IcedID..adjusted several times
Rule name:MAL_XMR_Miner_May19_1
Create hunting rule
Author:Florian Roth
Description:Detects Monero Crypto Coin Miner
Reference:https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Rule name:mimikatz
Create hunting rule
Author:Benjamin DELPY (gentilkiwi)
Description:mimikatz
Rule name:Mimikatz_Strings
Create hunting rule
Author:Florian Roth
Description:Detects Mimikatz strings
Reference:not set
Rule name:MINER_monero_mining_detection
Create hunting rule
Author:Christiaan Beek | McAfee ATR Team
Description:Monero mining software
Rule name:Ping_Command_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an suspicious ping command execution in an executable
Reference:Internal Research
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_mimikatz_w0
Create hunting rule
Author:Benjamin DELPY (gentilkiwi)
Description:mimikatz
Rule name:win_younglotus_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:XMRIG_Miner
Create hunting rule
Rule name:XMRIG_Monero_Miner
Create hunting rule
Author:Florian Roth
Description:Detects Monero mining software
Reference:https://github.com/xmrig/xmrig/releases

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments