MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 009206d0bb95a4dbef8a24ad9d75434e0dc86caaba9f098c8f91aa6700adf956. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 17


Intelligence 17 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 009206d0bb95a4dbef8a24ad9d75434e0dc86caaba9f098c8f91aa6700adf956
SHA3-384 hash: 4acd4b2543d30e26cc108b4e7b15729339bc6ff603584c52c2c9fa197f9b1b7d3700e607e8943f3c5574775d5e2932f6
SHA1 hash: 0573cf32ea007af98cbb727e3f71ae480f4839e1
MD5 hash: 0ca63d39fdb5f2ae5bb99f2fb6ef0ca6
humanhash: beryllium-arkansas-oklahoma-speaker
File name:009206D0BB95A4DBEF8A24AD9D75434E0DC86CAABA9F0.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:4'072'425 bytes
First seen:2023-02-06 15:15:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c05041e01f84e1ccca9c4451f3b6a383 (141 x RedLineStealer, 103 x GuLoader, 64 x DiamondFox)
ssdeep 98304:yvqgDo5X6AW5odOGVhCO1wxT+Wa0vL+D0TzEVdTWOe64:yvPuKd6VhCgwxT+mvyD0z64
Threatray 1'577 similar samples on MalwareBazaar
TLSH T1511633A5BB43FE93D16BB1B0341DAA5A129ED502262F96770B049D44701BFC6283FFE4
TrID 39.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.5% (.SCR) Windows screen saver (13097/50/3)
13.3% (.EXE) Win64 Executable (generic) (10523/12/4)
8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:CoinMiner exe


Avatar
abuse_ch
CoinMiner C2:
20.172.169.121:50422

Intelligence

File Origin
# of uploads :
1
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
009206D0BB95A4DBEF8A24AD9D75434E0DC86CAABA9F0.exe
Verdict:
Malicious activity
Analysis date:
2023-02-06 15:17:50 UTC
Tags:
evasion trojan loader smoke opendir socelars stealer miner rat redline
Link:
https://app.any.run/tasks/824430a5-9b8c-4e8a-b0b7-ff208677b058

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/360951/
Detection(s):
Win.Packed.Barys-9859531-0
Create hunting rule

Win.Malware.Generic-9863888-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

Win.Dropper.Generickdz-9890302-0
Create hunting rule

Win.Dropper.Upatre-9890301-1
Create hunting rule

Win.Dropper.Generickdz-9890921-0
Create hunting rule

Win.Dropper.Generickdz-9898168-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
Searching for the window
Running batch commands
Sending a custom TCP request
Searching for synchronization primitives
Launching a process
Creating a window
Launching the default Windows debugger (dwwin.exe)
Creating a process with a hidden window
DNS request
Sending an HTTP GET request
Reading critical registry keys
Query of malicious DNS domain
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/65827/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
arkeistealer overlay packed shell32.dll virus
Link:
https://www.filescan.io/uploads/63e119b3447edb203a02ed54/reports/04a0a33e-972a-4274-bcdc-4f3b6fbe42aa/overview
Verdict:
Malicious
Labled as:
Dropper.Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/009206d0bb95a4dbef8a24ad9d75434e0dc86caaba9f098c8f91aa6700adf956
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Vidar
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2b6bd58d-595b-456d-8e41-6ff056ea0b3e
Result
Threat name:
Nymaim, PrivateLoader, RedLine, Vidar, X
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1166761
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Connects to a pastebin service (likely for C&C)
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Detected VMProtect packer
Disable Windows Defender real time protection (registry)
DNS related to crypt mining pools
Found C&C like URL pattern
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
Performs DNS queries to domains with low reputation
Sample is not signed and drops a device driver
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to resolve many domain names, but no domain seems valid
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Nymaim
Yara detected onlyLogger
Yara detected PrivateLoader
Yara detected RedLine Stealer
Yara detected Vidar stealer
Yara detected Xmrig cryptocurrency miner
Yara Genericmalware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 799531 Sample: 009206D0BB95A4DBEF8A24AD9D7... Startdate: 06/02/2023 Architecture: WINDOWS Score: 100 141 xmr-eu2.nanopool.org 2->141 143 qwertys.info 2->143 145 9 other IPs or domains 2->145 191 Snort IDS alert for network traffic 2->191 193 Malicious sample detected (through community Yara rule) 2->193 195 Antivirus detection for URL or domain 2->195 201 23 other signatures 2->201 14 009206D0BB95A4DBEF8A24AD9D75434E0DC86CAABA9F0.exe 10 2->14         started        17 services64.exe 2->17         started        signatures3 197 Connects to a pastebin service (likely for C&C) 141->197 199 DNS related to crypt mining pools 143->199 process4 file5 139 C:\Users\user\AppData\...\setup_installer.exe, PE32 14->139 dropped 20 setup_installer.exe 16 14->20         started        187 Multi AV Scanner detection for dropped file 17->187 signatures6 process7 file8 101 C:\Users\user\AppData\...\setup_install.exe, PE32 20->101 dropped 103 C:\Users\user\AppData\...\libwinpthread-1.dll, PE32 20->103 dropped 105 C:\Users\user\AppData\...\libstdc++-6.dll, PE32 20->105 dropped 107 11 other files (10 malicious) 20->107 dropped 203 Multi AV Scanner detection for dropped file 20->203 24 setup_install.exe 1 20->24         started        signatures9 process10 dnsIp11 149 127.0.0.1 unknown unknown 24->149 151 hsiens.xyz 24->151 237 Multi AV Scanner detection for dropped file 24->237 239 Performs DNS queries to domains with low reputation 24->239 241 Adds a directory exclusion to Windows Defender 24->241 28 cmd.exe 1 24->28         started        30 cmd.exe 1 24->30         started        32 cmd.exe 1 24->32         started        34 8 other processes 24->34 signatures12 process13 dnsIp14 38 Sun04ddbe6ae6af2.exe 28->38         started        42 Sun046e678a4a9d55dff.exe 30->42         started        45 Sun04efa056f96f18d35.exe 3 32->45         started        147 a.goatgame.co 34->147 189 Adds a directory exclusion to Windows Defender 34->189 47 Sun04f7e9f619.exe 34->47         started        49 Sun043329cdf1893383.exe 34->49         started        51 Sun04fcc16f51894a23.exe 34->51         started        53 3 other processes 34->53 signatures15 process16 dnsIp17 109 C:\Users\user\AppData\Local\Temp\setup.exe, PE32 38->109 dropped 111 C:\Users\user\AppData\...\jzhang-game.exe, PE32 38->111 dropped 113 C:\Users\user\AppData\Local\Temp\jhuuee.exe, PE32+ 38->113 dropped 123 4 other malicious files 38->123 dropped 205 Multi AV Scanner detection for dropped file 38->205 55 chrome3.exe 38->55         started        59 2.exe 38->59         started        62 jhuuee.exe 38->62         started        70 4 other processes 38->70 153 212.193.30.115, 49714, 49718, 80 SPD-NETTR Russian Federation 42->153 163 19 other IPs or domains 42->163 115 C:\Users\...\qKYoBpYcacyeCtXiocMuljWf.exe, PE32 42->115 dropped 117 C:\Users\...\eSzdUOKog6TbIH6b390n2iXN.exe, PE32 42->117 dropped 119 C:\Users\...\Qx4Kt5J_YHLFzyvsU5NrOyai.exe, PE32 42->119 dropped 125 16 other malicious files 42->125 dropped 207 May check the online IP address of the machine 42->207 209 Creates HTML files with .exe extension (expired dropper behavior) 42->209 211 Tries to harvest and steal browser information (history, passwords, etc) 42->211 213 Disable Windows Defender real time protection (registry) 42->213 72 2 other processes 42->72 165 6 other IPs or domains 45->165 215 Detected unpacking (changes PE section rights) 45->215 217 Performs DNS queries to domains with low reputation 45->217 121 C:\Users\user\AppData\...\Sun04f7e9f619.tmp, PE32 47->121 dropped 219 Obfuscated command line found 47->219 64 Sun04f7e9f619.tmp 47->64         started        155 eduarroma.tumblr.com 74.114.154.18, 443, 49723 AUTOMATTICUS Canada 49->155 221 Detected unpacking (overwrites its own PE header) 49->221 66 WerFault.exe 49->66         started        74 2 other processes 49->74 157 ip-api.com 208.95.112.1, 49704, 80 TUT-ASUS United States 51->157 159 a.goatgame.co 53->159 161 s.lletlee.com 53->161 68 explorer.exe 53->68 injected file18 223 Tries to resolve many domain names, but no domain seems valid 159->223 signatures19 process20 dnsIp21 127 C:\Users\user\AppData\...\services64.exe, PE32+ 55->127 dropped 225 Multi AV Scanner detection for dropped file 55->225 76 services64.exe 55->76         started        81 cmd.exe 55->81         started        167 qwertys.info 59->167 227 Antivirus detection for dropped file 59->227 229 Machine Learning detection for dropped file 59->229 169 s.lletlee.com 62->169 175 4 other IPs or domains 62->175 231 Performs DNS queries to domains with low reputation 62->231 171 best-link-app.com 64->171 177 2 other IPs or domains 64->177 129 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 64->129 dropped 131 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 64->131 dropped 133 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 64->133 dropped 173 194.145.227.161 CLOUDPITDE Ukraine 70->173 179 4 other IPs or domains 70->179 83 conhost.exe 70->83         started        85 conhost.exe 70->85         started        87 WerFault.exe 70->87         started        89 WerFault.exe 70->89         started        file22 233 May check the online IP address of the machine 169->233 235 Tries to resolve many domain names, but no domain seems valid 171->235 signatures23 process24 dnsIp25 181 github.com 140.82.121.3, 443, 49725 GITHUBUS United States 76->181 183 raw.githubusercontent.com 185.199.108.133 FASTLYUS Netherlands 76->183 185 sanctam.net 76->185 135 C:\Users\user\AppData\...\sihost64.exe, PE32+ 76->135 dropped 137 C:\Users\user\AppData\Roaming\...\WR64.sys, PE32+ 76->137 dropped 243 Sample is not signed and drops a device driver 76->243 245 Injects a PE file into a foreign processes 76->245 91 cmd.exe 76->91         started        247 Uses schtasks.exe or at.exe to add and modify task schedules 81->247 93 conhost.exe 81->93         started        95 schtasks.exe 81->95         started        file26 signatures27 process28 process29 97 conhost.exe 91->97         started        99 schtasks.exe 91->99         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/009206d0bb95a4dbef8a24ad9d75434e0dc86caaba9f098c8f91aa6700adf956/
Threat name:
Win32.Trojan.Redlinestealer
Create hunting rule
Status:
Malicious
First seen:
2021-08-30 07:45:00 UTC
File Type:
PE (Exe)
Extracted files:
110
AV detection:
29 of 39 (74.36%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=acjanuf3swsnx34keswz25kdjyg4q3fkxkpqtdepsgvgoafn7fla._file
Verdict:
malicious
Similar samples:
47e9b75457446a3b3c86622dd282065b0f88603e2c009670c1f7eaf00183a407
CoinMiner
54bcd3308c140c8ec030f98697cc7f0e9d4585d54334a2eb77c58879510d5c8c
CoinMiner
6dfd902231e6aa1301c11eca21f5a29456aa020bfe1eb19d05541ab32316a326
CoinMiner
a412840c44db8bca039ce13176d7d6b9be9b2cbd1ef81eb85cd2f0c9180f6511
CoinMiner
bf9714f60c2b4b43cc0383b3155d9c737271916032051df041fed54d34f7c765
CoinMiner
f9c9b3fbf4d11f96ff06fc8292d8c67ad6cf5432409754bbfc95c5c80e6b160d
CoinMiner
+ 1'567 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:fabookie family:gcleaner family:nullmixer family:onlylogger family:privateloader family:smokeloader family:vidar family:xmrig botnet:706 aspackv2 backdoor dropper evasion loader main miner spyware stealer trojan upx
Link:
https://tria.ge/reports/230206-snfnbsee85/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: LoadsDriver
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Program crash
Enumerates physical storage devices
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
ASPack v2.12-2.42
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
UPX packed file
OnlyLogger payload
Vidar Stealer
XMRig Miner payload
Detect Fabookie payload
Detects Smokeloader packer
Fabookie
GCleaner
Modifies Windows Defender Real-time Protection settings
NullMixer
OnlyLogger
PrivateLoader
SmokeLoader
Vidar
xmrig
Malware Config
C2 Extraction:
http://hsiens.xyz/
http://37.0.10.214/proxies.txt
http://37.0.10.244/server.txt
http://wfsdragon.ru/api/setStats.php
37.0.10.237
http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
https://eduarroma.tumblr.com/
194.145.227.161
Unpacked files
SH256 hash:
009206d0bb95a4dbef8a24ad9d75434e0dc86caaba9f098c8f91aa6700adf956
MD5 hash:
0ca63d39fdb5f2ae5bb99f2fb6ef0ca6
SHA1 hash:
0573cf32ea007af98cbb727e3f71ae480f4839e1
Link:
https://www.unpac.me/results/0e196f0f-e287-4312-9513-8014d18537ce/
Malware family:
RedNet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/009206d0bb95/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/009206d0bb95a4dbef8a24ad9d75434e0dc86caaba9f098c8f91aa6700adf956

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:INDICATOR_EXE_Packed_ASPack
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ASPack
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:MALWARE_Win_DLInjector03
Create hunting rule
Author:ditekSHen
Description:Detects unknown loader / injector
Rule name:MALWARE_Win_DLInjector06
Create hunting rule
Author:ditekSHen
Description:Detects downloader / injector
Rule name:MALWARE_Win_OnlyLogger
Create hunting rule
Author:ditekSHen
Description:Detects OnlyLogger loader variants
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:privateloader
Create hunting rule
Author:andretavare5
Description:PrivateLoader pay-per-install malware
Rule name:Privateloader_Main_Component
Create hunting rule
Description:Detects PrivateLoader Main Component
Rule name:RedOctoberPluginCollectInfo
Create hunting rule
Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()
Rule name:SUSP_XORed_Mozilla_RID2DB4
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research
Rule name:Windows_Trojan_PrivateLoader_96ac2734
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Vidar_114258d5
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Vidar_9007feb2
Create hunting rule
Author:Elastic Security
Rule name:win_gcleaner_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.gcleaner.
Rule name:win_privateloader
Create hunting rule
Rule name:win_privateloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.privateloader.
Rule name:win_privateloader_w0
Create hunting rule
Author:andretavare5
Reference:https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service
Rule name:win_vidar_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.vidar.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/360951/

Comments