MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07f2d4559c633807609f3169ccbc9bfa83d68791984cd52d519a46a738a676d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PureMiner

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	07f2d4559c633807609f3169ccbc9bfa83d68791984cd52d519a46a738a676d1
SHA3-384 hash:	4e0e48e97c4128630da90f4ed95a8c13d20f82c0c6d97e081ae6ed6ebbeccfb771f9bce86b126cad6cdc4c7b11f473e9
SHA1 hash:	fa0108e721257a868379ee057897621bbe1a4f24
MD5 hash:	5d95856b5ce8d1ea5b6b7e47f3d31cc9
humanhash:	purple-queen-kansas-beer
File name:	5d95856b5ce8d1ea5b6b7e47f3d31cc9.exe
Download:	download sample
Signature	PureMiner Create hunting rule
File size:	1'113'088 bytes
First seen:	2022-09-27 06:14:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	24576:Jaj/2DhbrFdA6lcIk+R5BzcuYvJDLpPp/WnJGJ9:sT2DhfFW3r05BzclhJPFWnJ
Threatray	2'689 similar samples on MalwareBazaar
TLSH	T197352368AF3EC902CCDCE875CB7B45463D74A7D01B0960077A44EB1DB1EAA37B41A936
TrID	63.5% (.EXE) Win64 Executable (generic) (10523/12/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):
dhash icon	d292b0b2da36bcbe (11 x AsyncRAT, 7 x Metasploit, 6 x CoinMiner)
Reporter	abuse_ch
Tags:	exe PureMiner

Intelligence

File Origin

# of uploads :

# of downloads :

261

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/313828/

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Launching a process

Creating a process with a hidden window

Unauthorized injection to a recently created process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/633294ea665fcdb8807a2c93/reports/02fbf1a4-5017-46f0-9235-78e1a943235c/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/ed931a8f-8b75-437c-be62-30cc1bd6d224

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1078036

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Antivirus / Scanner detection for submitted sample

Encrypted powershell cmdline option found

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Costura Assembly Loader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/07f2d4559c633807609f3169ccbc9bfa83d68791984cd52d519a46a738a676d1/

Threat name:

ByteCode-MSIL.Spyware.Noon

Status:

Malicious

First seen:

2022-09-26 22:13:03 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

11 of 25 (44.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a7znivm4mm4aoye7gfu4zpe37kb5nb4rtbgnklkrtjdkoofgo3iq._file

Verdict:

malicious

Label(s):

asyncrat

PureMiner

25c62b72f0555d7ebf9397ec0c8d124942be1b4cedd6848c0c0a8f4a63dc7741

PureMiner

8520356646a9f8421e70e5c49a30630e9fc7db344adbd8f9e66ff9746273ce73

PureMiner

8a63134b33062c4634272b96c12d130f3abe74270f958ac03049eaae8bb66de4

PureMiner

8c88e83a7d8ecdc337997e822c9ed368d6fe3bff0ff4e3b4b1b55a0cabeb09f1

PureMiner

953eea5757d78536aa654da079a8f04e87874043d848b938cce9fc9aa85ee83d

PureMiner

a72a4e1444e8a68185d3dd2fd9d47d3507976616f44aeb46c4b9384134a11fb0

PureMiner

c513c409f13b727d8f25afc5ecc32c9fbd6f2165e898f5035bad364de0e893fd

PureMiner

d8b8f7d0334857a3749963c08491c155c6743af96f8ad779101060ff71a9eca3

PureMiner

+ 2'679 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/220927-gzxkfadggp/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in System32 directory

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/f76ded61-73a1-4625-b822-8c7da67b3b25

Unpacked files

SH256 hash:

07f2d4559c633807609f3169ccbc9bfa83d68791984cd52d519a46a738a676d1

MD5 hash:

5d95856b5ce8d1ea5b6b7e47f3d31cc9

SHA1 hash:

fa0108e721257a868379ee057897621bbe1a4f24

Link:

https://www.unpac.me/results/3ee93f0e-653e-4871-8279-3afd0cf2c3c7/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/07f2d4559c63/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/07f2d4559c633807609f3169ccbc9bfa83d68791984cd52d519a46a738a676d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.