MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06a2134339a6ff05c2a61e3f796f1c192e9cadc13f8ba5a600e538e89f6c7e4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06a2134339a6ff05c2a61e3f796f1c192e9cadc13f8ba5a600e538e89f6c7e4d
SHA3-384 hash: 1c80cbad4d59962f5ef428bcaa09e446b9a5d522befeb31b02677302e3bb165996b34f3a5c0cf378c42340b6ef95af0a
SHA1 hash: 3e0b1644ece53570e0bc5ff4510ee47709507632
MD5 hash: 85ef0b629318f502fe3602ba97de74b3
humanhash: monkey-green-jersey-william
File name:85ef0b629318f502fe3602ba97de74b3.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:4'096 bytes
First seen:2021-11-14 07:19:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4bfde1223391e32fec766cd1d41fa3e7 (7 x CoinMiner, 1 x BitRAT, 1 x QuasarRAT)
ssdeep 48:6ft+ZzWsJ6QU71lWDT1Pe+EqKq3Zv8B13aLlzUR:XZzlgQUhlMT4+1vpkv3aLlYR
Threatray 147 similar samples on MalwareBazaar
TLSH T13E8194E3F6AADD3DC11305722EA243253BB183A331424A8EEE9D50FADF42C41640B34D
Reporter abuse_ch
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://bit.ly/30m8fzy
Verdict:
Malicious activity
Analysis date:
2021-11-13 17:36:30 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/57fcfd4e-c661-4839-b2bd-d2b5f9292b5c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/205616/
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.29665.31315.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a UDP request
Running batch commands
Launching a process
DNS request
Connection attempt
Creating a file in the %temp% directory
Creating a process from a recently created file
Downloading the file
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6190b8a73edf00a722d3456c/reports/f535cff0-9a41-4957-9a4b-0826eecdf5a3/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3d472deb-eaf6-4cad-aff3-ea1740c309b7
Result
Threat name:
BitCoin Miner
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/888802
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Powershell Defender Exclusion
Sigma detected: Powershell download and execute file
Sigma detected: PowerShell DownloadFile
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected BitCoin Miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 521275 Sample: JiEGJ4UMpz.exe Startdate: 14/11/2021 Architecture: WINDOWS Score: 100 72 Sigma detected: Powershell download and execute file 2->72 74 Multi AV Scanner detection for submitted file 2->74 76 Yara detected BitCoin Miner 2->76 78 3 other signatures 2->78 14 JiEGJ4UMpz.exe 2->14         started        17 fghtui.exe 2->17         started        process3 signatures4 110 Adds a directory exclusion to Windows Defender 14->110 19 cmd.exe 1 14->19         started        112 Multi AV Scanner detection for dropped file 17->112 114 Writes to foreign memory regions 17->114 116 Allocates memory in foreign processes 17->116 118 Creates a thread in another existing process (thread injection) 17->118 22 conhost.exe 17->22         started        process5 signatures6 80 Suspicious powershell command line found 19->80 82 Tries to download and execute files (via powershell) 19->82 84 Adds a directory exclusion to Windows Defender 19->84 24 powershell.exe 19->24         started        26 powershell.exe 23 19->26         started        29 powershell.exe 15 17 19->29         started        33 2 other processes 19->33 process7 dnsIp8 35 fgrvss.exe 24->35         started        100 Powershell drops PE file 26->100 70 cdn.discordapp.com 162.159.135.233, 443, 49755 CLOUDFLARENETUS United States 29->70 68 C:\Users\user\AppData\Local\Temp\fgrvss.exe, PE32+ 29->68 dropped file9 signatures10 process11 signatures12 86 Multi AV Scanner detection for dropped file 35->86 88 Writes to foreign memory regions 35->88 90 Allocates memory in foreign processes 35->90 92 Creates a thread in another existing process (thread injection) 35->92 38 conhost.exe 35->38         started        process13 file14 64 C:\Windows\System32\fghtui.exe, PE32+ 38->64 dropped 41 cmd.exe 38->41         started        44 cmd.exe 38->44         started        process15 signatures16 96 Drops executables to the windows directory (C:\Windows) and starts them 41->96 46 fghtui.exe 41->46         started        49 conhost.exe 41->49         started        98 Uses schtasks.exe or at.exe to add and modify task schedules 44->98 51 conhost.exe 44->51         started        53 schtasks.exe 44->53         started        process17 signatures18 120 Writes to foreign memory regions 46->120 122 Allocates memory in foreign processes 46->122 124 Creates a thread in another existing process (thread injection) 46->124 55 conhost.exe 46->55         started        process19 file20 66 C:\Windows\System32\...\sihost32.exe, PE32+ 55->66 dropped 94 Drops executables to the windows directory (C:\Windows) and starts them 55->94 59 sihost32.exe 55->59         started        signatures21 process22 signatures23 102 Multi AV Scanner detection for dropped file 59->102 104 Writes to foreign memory regions 59->104 106 Allocates memory in foreign processes 59->106 108 Creates a thread in another existing process (thread injection) 59->108 62 conhost.exe 59->62         started        process24
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/06a2134339a6ff05c2a61e3f796f1c192e9cadc13f8ba5a600e538e89f6c7e4d/
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-11-13 07:48:10 UTC
AV detection:
28 of 44 (63.64%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
12439fc7c876b8bf881db4e97ed57827c1c4f2fd0ebccc29a4e197b19c80488b
CoinMiner
139c83b8cf3674d992e04f9e4a047c3a7ad5279b2f6b8bf18c39603f82bca16d
CoinMiner
1505d3b595d18d1b255253b080bed85334916ff81174a5685a6f3f3433cbe746
CoinMiner
40387bebfe97eea9c90425caf5519019dfc0e7425bb238246ec9f7bb5d621293
CoinMiner
58f64e4083fa288b091dc0d29a050da9cd09e4ee6607aff2e5fa5ffbe2c7a887
CoinMiner
9b8c70d1c0537d946bf7233df72a7e0ebdff2cb70404a69ee6a2419730973462
CoinMiner
b41455dfe45bf98bd2f1acec07d7a0df02a3c83e1fdecfb403df3984ab794761
CoinMiner
d8ce2e5613b91a46eb15835e6d2aac47a715e2ab55a97163bdf2ed8ac350f7a1
CoinMiner
fd6996eab709c3ed21ef140958d9a9147902336b85b47bc896372a18e469a6fc
CoinMiner
+ 137 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig miner
Link:
https://tria.ge/reports/211114-h55zfagad7/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
xmrig
Malware Config
Dropper Extraction:
https://cdn.discordapp.com/attachments/908728351760453728/908728487655899239/miner.exe
Unpacked files
SH256 hash:
06a2134339a6ff05c2a61e3f796f1c192e9cadc13f8ba5a600e538e89f6c7e4d
MD5 hash:
85ef0b629318f502fe3602ba97de74b3
SHA1 hash:
3e0b1644ece53570e0bc5ff4510ee47709507632
Link:
https://www.unpac.me/results/63094070-778c-4594-b27d-d3fdb2e9f62b/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 06a2134339a6ff05c2a61e3f796f1c192e9cadc13f8ba5a600e538e89f6c7e4d

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/205616/
  
URLhaus
https://urlhaus.abuse.ch/url/1783598/
  
Delivery method
Distributed via web download

Comments