MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02aeff4e07664864d428440cab4be050ddc1504ff997ce0fef7068899139318d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02aeff4e07664864d428440cab4be050ddc1504ff997ce0fef7068899139318d
SHA3-384 hash: efa8bf755a702296447f223e506716c7f277889a73a6cce40669147e2168f7b0838a2265e6bcaf1f60068e2f5eb985db
SHA1 hash: d3b1051e21dc90dfab48e7562e3241940a3ba8fb
MD5 hash: 324e7a91b3f7291bca9a15ae827e5619
humanhash: friend-two-paris-jig
File name:5Mo1ZF.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:2'779'136 bytes
First seen:2022-09-22 13:28:46 UTC
Last seen:2022-09-22 15:11:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 49152:3IWNRTouhttQYoGn+k23j+yExL2feQIap1Q4Xu9+LTQMn57Jjr:rXTouhtiJSyEYmHapy4XzBr
TLSH T1B0D52386B41B823BC5CCB7FA717F46FF8424935B3656A110728705DCE90763AB88ED1A
TrID 63.5% (.EXE) Win64 Executable (generic) (10523/12/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon d292b0b2da36bcbe (11 x AsyncRAT, 7 x Metasploit, 6 x CoinMiner)
Reporter James_inthe_box
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
283
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5Mo1ZF.exe
Verdict:
No threats detected
Analysis date:
2022-09-22 13:29:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/36ef6976-9d36-4200-b9dd-eac7ff228664

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/312355/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1569.18966.16840.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Unauthorized injection to a recently created process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/632c6329d7368628f1c190df/reports/26a88cbe-3c53-4906-aea7-43a2bc17b8ce/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/c407f08c-e041-472e-8021-0be4555919a9
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1075306
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Encrypted powershell cmdline option found
Machine Learning detection for sample
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 707849 Sample: 5Mo1ZF.exe Startdate: 22/09/2022 Architecture: WINDOWS Score: 64 14 Antivirus / Scanner detection for submitted sample 2->14 16 .NET source code contains potential unpacker 2->16 18 Machine Learning detection for sample 2->18 20 Yara detected Costura Assembly Loader 2->20 7 5Mo1ZF.exe 3 2->7         started        process3 signatures4 22 Encrypted powershell cmdline option found 7->22 10 powershell.exe 14 7->10         started        process5 process6 12 conhost.exe 10->12         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02aeff4e07664864d428440cab4be050ddc1504ff997ce0fef7068899139318d/
Threat name:
ByteCode-MSIL.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-09-22 13:28:09 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
13
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=akxp6tqhmzegjvbiiqgkws7akdo4cucp7gl44d7pobuitejzgggq._file
Verdict:
malicious
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig miner upx
Link:
https://tria.ge/reports/220922-qq8qsabfb4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
UPX packed file
XMRig Miner payload
xmrig
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/45452402-8b41-4782-b4fc-125082aa5f0f
Unpacked files
SH256 hash:
02aeff4e07664864d428440cab4be050ddc1504ff997ce0fef7068899139318d
MD5 hash:
324e7a91b3f7291bca9a15ae827e5619
SHA1 hash:
d3b1051e21dc90dfab48e7562e3241940a3ba8fb
Link:
https://www.unpac.me/results/07a69132-417b-4aa9-a2b7-814c23210f8e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/02aeff4e0766/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/02aeff4e07664864d428440cab4be050ddc1504ff997ce0fef7068899139318d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/312355/

Comments