MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06a9de0b7a1ce8a57375a10ea12f030a618e5f56d695f7e582c6ff79e7554757. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	06a9de0b7a1ce8a57375a10ea12f030a618e5f56d695f7e582c6ff79e7554757
SHA3-384 hash:	bc39e78c4dcb7ced98371e1e0ce94fbded65d4361c6623cd57164d3e73845d8480e12f391d4bd249c239b01626459cba
SHA1 hash:	4942a26f4ee884b8b1a6468a1632af2bad4bec8e
MD5 hash:	5cd14942d071d4913f27b73dc36c7a11
humanhash:	fruit-cup-quiet-hydrogen
File name:	77system.vbs
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	4'810 bytes
First seen:	2024-04-16 22:31:54 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	48:4h/lhaRdU4v0rLp9dct0BLptfK00LpNtb0rLpOgJ0JLpqL9AZ/R08LpC9JMHiM3j:AOuNrN/BNj0NNtYrNOnJNqLiZ/u8NC8L
TLSH	T15CA10D0AEC05BFB36D03ABA88B1B4A119DBDF83F12295045BB4CDD445F32BB061207E6
Reporter	smica83
Tags:	CoinMiner UKR vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

110

Origin country :

HU

Vendor Threat Intelligence

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/06a9de0b7a1ce8a57375a10ea12f030a618e5f56d695f7e582c6ff79e7554757

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox Xmrig

Result

Threat name:

Xmrig

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1427081

Signature

.NET source code contains process injector

.NET source code references suspicious native API functions

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Creates files in the system32 config directory

Found strings related to Crypto-Mining

Found suspicious powershell code related to unpacking or dynamic code loading

Found Tor onion address

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Obfuscated command line found

Potential malicious VBS script found (has network functionality)

Potential malicious VBS script found (suspicious strings)

Query firmware table information (likely to detect VMs)

Sigma detected: Execution from Suspicious Folder

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential WinAPI Calls Via CommandLine

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious Program Location with Network Connections

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Sigma detected: WScript or CScript Dropper

Suspicious powershell command line found

System process connects to network (likely due to code injection or exploit)

Uses cmd line tools excessively to alter registry or file data

Uses dynamic DNS services

Uses known network protocols on non-standard ports

VBScript performs obfuscated calls to suspicious functions

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

7%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/06a9de0b7a1ce8a57375a10ea12f030a618e5f56d695f7e582c6ff79e7554757

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/06a9de0b7a1ce8a57375a10ea12f030a618e5f56d695f7e582c6ff79e7554757/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Heuristic

Threat name:

Script-WScript.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-04-16 11:27:02 UTC

File Type:

Text (VBS)

AV detection:

7 of 23 (30.43%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a2u54c32dtukk43vuehkclydbjqy4x2w22k7pzmcy37xtz2vi5lq._file

Threatray malicious

Verdict:

malicious

Hatching Triage xmrig

Result

Malware family:

xmrig

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xmrig miner

Link:

https://tria.ge/reports/240416-2fx23sfh71/

Behaviour

Modifies data under HKEY_USERS

Modifies registry key

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in System32 directory

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

Suspicious use of NtCreateUserProcessOtherParentProcess

XMRig Miner payload

xmrig

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/06a9de0b7a1ce8a57375a10ea12f030a618e5f56d695f7e582c6ff79e7554757