MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0aa10160545e1930e0a2bc2fa9a48c6842bffc478caceaaec30442ea3673c02c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0aa10160545e1930e0a2bc2fa9a48c6842bffc478caceaaec30442ea3673c02c
SHA3-384 hash: f6dc845d015e7ee246905241c32281cc992ed78c7fc2ade962abeb073c6d5590eb044143d80718e8aa9d3168ecbffd3d
SHA1 hash: ef4090398624add6602d98dc9198b332a56f2285
MD5 hash: c799ad5e9d6605560d1fe6fe34b49ae8
humanhash: utah-east-carpet-single
File name:0aa10160545e1930e0a2bc2fa9a48c6842bffc478caceaaec30442ea3673c02c
Download: download sample
File size:5'462'939 bytes
First seen:2020-11-10 07:55:44 UTC
Last seen:2024-07-24 11:04:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 227fe66ff6f22dec0266a5718d365ece (39 x CoinMiner, 1 x CobaltStrike, 1 x Berbew)
ssdeep 49152:ROdWCCi7/ra756uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBib856utgpPFotBER/mQ32lUf
Threatray 259 similar samples on MalwareBazaar
TLSH F3465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
Reporter seifreed

Intelligence

File Origin
# of uploads :
2
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.CobaltStrike-8091534-0
Create hunting rule

Win.Tool.CobaltStrike-6336852-0
Create hunting rule

Win.Trojan.Razy-7331645-0
Create hunting rule

Win.Trojan.Razy-7332867-0
Create hunting rule

Win.Trojan.Razy-7364523-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Connection attempt to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
CobaltStrike Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/527900
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)
Drops executables to the windows directory (C:\Windows) and starts them
Found strings related to Crypto-Mining
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Yara detected CobaltStrike
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0aa10160545e1930e0a2bc2fa9a48c6842bffc478caceaaec30442ea3673c02c/
Threat name:
Win64.Trojan.CoinMiner
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 07:58:55 UTC
AV detection:
36 of 48 (75.00%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
24343537bd4eebe147a3e01b7ef74cf0e60082fe0a976d68be10ca261d2b6ee1
33369705401ac41b7c9ad1ca4813d578c232f04903f8c1c6784407de871be6f7
36d4dfbd3d0ebad99bc8c6f4ed63297fdac990714ed8db3781f12692019aef59
3d310ac77128eeb8420eb2801665537f2d68f47cc1fcfcb58778f51fdc92b86f
7eab136ce2cf0217512d9453216dd31fde0c58037a36761a4a98670b1fcd49ed
a1ac074204dcb72d6873db3cbb4abd108aaa6b64563064cf530fb365547ec05a
bb7e32a1873db5fbaafb2ef0f60e6bc12e07021c37965d987876ca4e3a80366a
c3060d13558f58e9894188ef3271e8ba156d88540bca888eed07a50d05dd73db
f17683c0720c1ee70362ee0b0c101f2ea4b26a676ac4f3a51af81ad78566271b
f8c274db25e3a171ac12f9b64fe67fe49d4ff4d64fbee98ef2d640cffa07e842
+ 249 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike backdoor trojan upx
Link:
https://tria.ge/reports/201110-14lc2qvpmj/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
JavaScript code in executable
Loads dropped DLL
Executes dropped EXE
UPX packed file
Cobalt Strike reflective loader
Cobaltstrike
Malware Config
C2 Extraction:
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments