MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 033b21c0aac19cb2813b4aaa0e4662135d3a2b80ac47c90349c6fcaaf9022a65. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 033b21c0aac19cb2813b4aaa0e4662135d3a2b80ac47c90349c6fcaaf9022a65
SHA3-384 hash: 44a59b2e3a1b559f5665eba60c247aaa85dcdc1c799e253875809d970e898fa19ce605d9441d388d924ff7a4a2aeb663
SHA1 hash: d69be0c76b932b61c3b824f99b44850fd2a287f3
MD5 hash: 93d437dc3d8728580fd4c843b83cc897
humanhash: nineteen-india-victor-july
File name:033b21c0aac19cb2813b4aaa0e4662135d3a2b80ac47c90349c6fcaaf9022a65
Download: download sample
File size:5'957'754 bytes
First seen:2020-11-10 08:43:52 UTC
Last seen:2024-07-24 10:46:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 71f37f91c14c4729e462a32b6b2ae9d4 (27 x CoinMiner, 12 x CobaltStrike)
ssdeep 98304:bsZv/sAdfE0pZBS56utgpPFotBER/mQ32lUN:49656utgpPF8u/7N
Threatray 180 similar samples on MalwareBazaar
TLSH 55565D41EDAB05F2EB8711308CB74E5F633372190335EAC3DA650A6FE9276E46A36741
Reporter seifreed

Intelligence

File Origin
# of uploads :
2
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.CobaltStrike-8091534-0
Create hunting rule

Win.Tool.CobaltStrike-6336852-0
Create hunting rule

Win.Coinminer.Generic-7151250-0
Create hunting rule

Win.Coinminer.Generic-7151253-0
Create hunting rule

Win.Coinminer.Generic-7151447-0
Create hunting rule

Win.Coinminer.Generic-7151488-0
Create hunting rule

Win.Coinminer.Generic-7155777-0
Create hunting rule

Win.Coinminer.Generic-7158858-0
Create hunting rule

Win.Trojan.Razy-7331645-0
Create hunting rule

Win.Trojan.Razy-7332867-0
Create hunting rule

Multios.Coinminer.Miner-6781728-2
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/033b21c0aac19cb2813b4aaa0e4662135d3a2b80ac47c90349c6fcaaf9022a65/
Threat name:
Win64.Trojan.CoinMiner
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 08:46:44 UTC
AV detection:
38 of 48 (79.17%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
153217a5bf1234b3fc50ea239b3d2574b50504ceb873d543c1c635820659ab32
2a03af662a64d3deb050b7a329060214b46dbb817aeb1fed697929b3db962388
2d1944507ece8757b364b80692ab3130927f7451075bbc8277ebb9ac2052e176
4794c7273241f1a4540abcb6de606c820d00f9259434c23c74780537edb939d6
566ec411a3c5356229e31bae147881f130d905dce7b5ee21260f3ddbac78a890
5bc57cc735f0fb5ede1bb9e4b06c0d6dbea40b0ffde1b660b0d0efe77a66b030
7b89cadbd49bd5589dc1b215e42e725cad3a0985465c3bc3db46a0e34b3a47a3
b8f81f63f336ad6e316a14088026e3be40fc475f064481b68b817a66ed5006cd
e7413fc8b99f6b7963338bceb3b8c77750503cb00797674e6dea51c9bb5d88c8
f678645ff7206bc1c9e82435f4f029893d8c117fab2c9e3984dfe47addf3c94c
+ 170 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike
Link:
https://tria.ge/reports/201110-y8egerm97e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Malware Config
C2 Extraction:
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments