MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 17

Intelligence 17 IOCs YARA 3 File information Comments

SHA256 hash:	01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83
SHA3-384 hash:	1209dd656108deb4b9691148eb3b29461d3627d670deed64f8cf5c696b029d23e8b8e881b8922420e72d9d2f297e824c
SHA1 hash:	03287a15bfd67ff8c3340c0bae425ecaa37a929f
MD5 hash:	02aa02aee2a6bd93a4a8f4941a0e6310
humanhash:	leopard-bluebird-chicken-lithium
File name:	c3p.exe
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	3'127'301 bytes
First seen:	2024-06-12 18:11:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4cfda23baf1e2e983ddfeca47a5c755a (33 x RedLineStealer, 6 x Dridex, 5 x NetSupport)
ssdeep	49152:YKbiWztohDIZZYiOG2qPX4xRgPZcUAtijL+kOqxvDUuPBBVFJt6NGGTDVOXLyago:YKGWJ6sDYI2qPX4fgPZcUAUjSkXvDUin
Threatray	347 similar samples on MalwareBazaar
TLSH	T177E5333174A08033E113443587D4D7366879B9749A322A9EFF548A7D7F21EA2C267BB3
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	cdabae6fe6e7eaec (22 x Amadey, 9 x AurotunStealer, 8 x CoinMiner)
Reporter	sentotayam
Tags:	CoinMiner exe miner

Intelligence

File Origin

# of uploads :

# of downloads :

424

Origin country :

Vendor Threat Intelligence

Malware family:

xmrig

ID:

File name:

01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe

Verdict:

Malicious activity

Analysis date:

2024-06-12 18:16:36 UTC

Tags:

miner xmrig

Link:

https://app.any.run/tasks/a680ffa0-deba-41e9-bba6-da66c1d9f091

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.PWS.Stealer.24943.1502.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6669e4e5a2bce47be7d80775win10vpnfull_triage

Tags:

Encryption Execution Generic Network Static Stealth Trojan Malware Coinminer02

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the Windows subdirectories

Running batch commands

Creating a process from a recently created file

Creating a service

Launching a process

Launching a service

Enabling the 'hidden' option for recently created files

Launching the process to change the firewall settings

DNS request

Connection attempt

Sending a custom TCP request

Loading a system driver

Enabling autorun for a service

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug byovd coinminer crypto epmicrosoft_visual_cc fingerprint installer lolbin microsoft_visual_cc miner monero netsh overlay packed pup sfx shell32 svchost.exe xmrig

Link:

https://www.filescan.io/uploads/6669e4fc21581a92819c8c91/reports/6080d8ac-12f7-4fcb-a935-35ba1a57a4f1/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83

Malware family:

XMRig Miner

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/42a8ebd6-7919-4038-ad5c-d9dbbeb5680a

Result

Threat name:

Xmrig

Detection:

malicious

Classification:

evad.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1456175

Signature

Antivirus detection for dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Drops PE files with benign system names

Found strings related to Crypto-Mining

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Modifies the windows firewall

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Suspect Svchost Activity

Sigma detected: System File Execution Location Anomaly

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Score:

90%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83/

Threat name:

Win32.Trojan.DisguisedXMRigMiner

Status:

Malicious

First seen:

2024-04-25 13:04:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 38 (68.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=aguxnoackncqucoqxcihl5p2si5diejgl554r42bhucz7vtcvkbq._file

Verdict:

malicious

CoinMiner

b64c57f3f83e58764714885b3a0e16a543cfff24ae800ff5dd2540f92b4d46f4

CoinMiner

be2a74bc76e5429010ce7741e58aecc253a33e1dbd713d8b6f02a20545469502

CoinMiner

c4841e9b7456e77872f4ac49d68c54d26df696ce090833f4449ae7bf5057eb0f

CoinMiner

db001e5eed23e82bc4bdd96f95d6db26e8209a087a6a09ea5434346b3d7e7856

CoinMiner

dc3b1cd6cc70e681b959bf718ba3a91ac4d5f6c0dfe49fa6ef0f6a7092a5690d

CoinMiner

ea35797a9556636378031645a48f089087cd258f8e40e1399aa371b2cca3cb7f

CoinMiner

fb76386ce3f17a25d59046a70cc05898bcccc7422ab92681777071e46d8943e5

CoinMiner

+ 337 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig evasion miner

Link:

https://tria.ge/reports/240612-ws6l4aybrq/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Enumerates physical storage devices

Drops file in Windows directory

Launches sc.exe

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Modifies Windows Firewall

Sets file to hidden

XMRig Miner payload

xmrig

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/fdddd4d0-cb2c-4fea-b4b1-01cb9a4034bf

Unpacked files

SH256 hash:

d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4

MD5 hash:

e2fe87cc2c7dab8ca6516620dccd1381

SHA1 hash:

f714ec0448325435103519452610cf7aadf8bbba

Detections:

XMRig

MALWARE_Win_CoinMiner02

XMRIG_Monero_Miner

MAL_XMR_Miner_May19_1

Link:

https://www.unpac.me/results/92338d95-a509-4b45-aa4b-e5016da80dda/

Parent samples :

e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6
e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0
01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83

SH256 hash:

11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

MD5 hash:

0c0195c48b6b8582fa6f6373032118da

SHA1 hash:

d25340ae8e92a6d29f599fef426a2bc1b5217299

Detections:

PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD

Link:

https://www.unpac.me/results/92338d95-a509-4b45-aa4b-e5016da80dda/

Parent samples :

efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8
40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779
e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6
e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0
01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83
f49dd9baed6ec113ad16bcd07e50ab5dc1ca98ef4797712cbf3f2f5463a16d41
22289a61cd8a347a03da845d34820534b3e617781447a91c6a0fb3b1e6f6a184
21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
235c665b25c1e78fed3ca96e57c374e5a416aad1d27b4ae436a1c6c58604268b
c8a83c6c8f797e36eb7a5edf0e5f85a8d985895c82932422b95bf628f4106dfb
ed3ce2006fbfa402977bb026324637b905c5cc8228254b88037d3f68152463d3
a7a9d6a874f65ea3689930a2af208a025fee0a3dc1ad5cb9c964cbadd2cacf1f
67bf6d0a4de17f79de1347b75c9d1af3106448a806132cf50b38c2c8aa19d8ea
254a713d3ec2852b6657ecb8840efd2662e048ace42c2b4e0b30c589cdb9f8cb
6353b1218561a746bb3e009b611a1945bc2367b4d3ffef7849d4af4d369f184c
4f85b6d87dcc12f7904f95f3716b18930c63cb18bd624c1abcbdd9181ba4efc2
e93433169e2ec088a21ee58ae3e780f68215eb75dcd31b83d1fa31d6c16145e5
1214268764f9252ca840f1cc7e9b3698ed55f059802fa7ab7442f61144d898d0
803b90be4767757819d2be13b6d6a36d1af1383495a31a5932cfd50bacb4c717
9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e
84b896f2d6f255b3e0130be2b4a3892e16b8970dd47e8da0cf8ad5271fd86c95
c1dd42c5d06153184430f7b1843200d21308e78ce9403c99f7b18c8682acabca
0714af49edc930cea4e4d0345090d71f04ce97093bd487a9ce36e1b18d27f8d2

SH256 hash:

d20f7bd5caa6a934df8b779b013a9cf90cf1f990145fad8ccc8aec34fd1f63c4

MD5 hash:

7fef8973663ad0c75fba75ca7c2df581

SHA1 hash:

8b7e2dca903c96ba5ad99fcfb2f41a859a769b9b

Link:

https://www.unpac.me/results/92338d95-a509-4b45-aa4b-e5016da80dda/

SH256 hash:

01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83

MD5 hash:

02aa02aee2a6bd93a4a8f4941a0e6310

SHA1 hash:

03287a15bfd67ff8c3340c0bae425ecaa37a929f

Link:

https://www.unpac.me/results/92338d95-a509-4b45-aa4b-e5016da80dda/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

exe 01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83

(this sample)

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::SetFileSecurityW
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExW SHELL32.dll::SHFileOperationW SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_API	Can Create Process and Threads	ADVAPI32.dll::OpenProcessToken KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineW KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::WriteConsoleA KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW KERNEL32.dll::CreateFileMappingW KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileA KERNEL32.dll::DeleteFileW
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::FindWindowExW USER32.dll::PeekMessageW USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample