MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f61c7d939ea77fff7eb409522338347b140beb1c5977bd0fc84ff301dd31605. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner.XMRig


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f61c7d939ea77fff7eb409522338347b140beb1c5977bd0fc84ff301dd31605
SHA3-384 hash: a46c68940b19e47fc16f243208f7f72e68d9e42188e50c43419c87f60843802b68206383f6836247ec965d079f0387b2
SHA1 hash: f6e91d1e642b7e9762b0ecc2e36b6fc489da4a13
MD5 hash: 4edbae4f41dbfff3675a867fe06ea0db
humanhash: comet-burger-april-jig
File name:4edbae4f41dbfff3675a867fe06ea0db.exe
Download: download sample
Signature CoinMiner.XMRig
Create hunting rule
File size:130'048 bytes
First seen:2021-12-21 12:16:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 148d482ece6903c9871bc6044bd1df9b (1 x CoinMiner.XMRig, 1 x GCleaner, 1 x Tofsee)
ssdeep 3072:Ix3W04qaxUUI4Y+TM4UzqlwGCD+IgQn0uG4PkWZNRgaWrSJSDhixGW2pldwuMmzA:IchAXD+UFkWDiwwixv+0uMmzv34
Threatray 625 similar samples on MalwareBazaar
TLSH T1C2D35E97B4C2C0B3E5A6193756A4ED74852FF4220B659DE723540D3B4E701C26E33EAB
File icon (PE):PE icon
dhash icon aab292b2b2c8e0ae (1 x CoinMiner.XMRig, 1 x GCleaner, 1 x Tofsee)
Reporter abuse_ch
Tags:CoinMiner.XMRig exe


Avatar
abuse_ch
CoinMiner.XMRig C2:
2.56.56.126:38524

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
2.56.56.126:38524 https://threatfox.abuse.ch/ioc/279862/

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4edbae4f41dbfff3675a867fe06ea0db.exe
Verdict:
No threats detected
Analysis date:
2021-12-21 12:18:34 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a009f1da-a0d5-4f7a-a9ae-8e575bd1d3cf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DLInjector06
Create hunting rule
Link:
https://www.capesandbox.com/analysis/215647/
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Reading critical registry keys
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Creating a window
Searching for analyzing tools
Searching for the window
Launching the default Windows debugger (dwwin.exe)
Blocking the Windows Defender launch
Unauthorized injection to a recently created process
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/2844/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
greyware
Link:
https://www.filescan.io/uploads/61c1c5c1ec6c6c14a9e77aac/reports/50f8a1d7-777f-430e-95c0-cd3ad4a4d767/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ryuk
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/32bd6621-7f64-4e48-acf0-2b8d1bd082cd
Result
Threat name:
RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/910919
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Connects to a pastebin service (likely for C&C)
Connects to many ports of the same IP (likely port scanning)
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (creates a PE file in dynamic memory)
Disable Windows Defender real time protection (registry)
Downloads files with wrong headers with respect to MIME Content-Type
Found C&C like URL pattern
Hides threads from debuggers
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Obfuscated command line found
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected WebBrowserPassView password recovery tool
Yara Genericmalware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 543396 Sample: wpJqviS40a.exe Startdate: 21/12/2021 Architecture: WINDOWS Score: 100 93 www.google.com 172.217.168.36, 49830, 49842, 80 GOOGLEUS United States 2->93 95 www.profitabletrustednetwork.com 2->95 97 15 other IPs or domains 2->97 133 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->133 135 Antivirus detection for URL or domain 2->135 137 Antivirus detection for dropped file 2->137 139 17 other signatures 2->139 9 wpJqviS40a.exe 4 35 2->9         started        signatures3 process4 dnsIp5 119 212.193.30.45, 49743, 80 SPD-NETTR Russian Federation 9->119 121 2.56.59.42, 49745, 49752, 49780 GBTCLOUDUS Netherlands 9->121 123 13 other IPs or domains 9->123 61 C:\Users\...\qHB68sWQPPMylkoZsLxwMSMZ.exe, PE32 9->61 dropped 63 C:\Users\...\VwkzUXaMDf7eQz5QYY0JljPZ.exe, PE32 9->63 dropped 65 C:\Users\...\Tk6HfVP5RHksoIJh5__wti0R.exe, PE32+ 9->65 dropped 67 9 other files (7 malicious) 9->67 dropped 145 Detected unpacking (creates a PE file in dynamic memory) 9->145 147 May check the online IP address of the machine 9->147 149 Creates HTML files with .exe extension (expired dropper behavior) 9->149 151 Disable Windows Defender real time protection (registry) 9->151 14 ERQpu9KBKEE1MeqcaBsV8Pho.exe 2 9->14         started        18 qHB68sWQPPMylkoZsLxwMSMZ.exe 2 9->18         started        20 Tk6HfVP5RHksoIJh5__wti0R.exe 1 2 9->20         started        23 5 other processes 9->23 file6 signatures7 process8 dnsIp9 85 C:\Users\...RQpu9KBKEE1MeqcaBsV8Pho.tmp, PE32 14->85 dropped 153 Obfuscated command line found 14->153 25 ERQpu9KBKEE1MeqcaBsV8Pho.tmp 14->25         started        87 C:\Users\...\qHB68sWQPPMylkoZsLxwMSMZ.tmp, PE32 18->87 dropped 29 qHB68sWQPPMylkoZsLxwMSMZ.tmp 3 19 18->29         started        99 ip-api.com 208.95.112.1, 49777, 80 TUT-ASUS United States 20->99 101 www.hhiuew33.com 45.136.151.102, 49784, 49794, 49829 ENZUINC-US Latvia 20->101 89 C:\Users\user\AppData\Local\Temp\11111.exe, PE32 20->89 dropped 31 11111.exe 1 20->31         started        34 11111.exe 20->34         started        103 2.56.56.126, 38524, 49787 GBTCLOUDUS Netherlands 23->103 105 ad-postback.biz 82.118.234.104, 49798, 80 DAINTERNATIONALGROUPGB Bulgaria 23->105 91 C:\Users\...\pidHTSIGEi8DrAmaYu9K8ghN89.dll, PE32+ 23->91 dropped 155 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 23->155 157 Maps a DLL or memory area into another process 23->157 159 Hides threads from debuggers 23->159 161 Checks if the current machine is a virtual machine (disk enumeration) 23->161 36 WerFault.exe 23->36         started        file10 signatures11 process12 dnsIp13 125 baganda.s3.pl-waw.scw.cloud 25->125 69 C:\Users\user\AppData\...\Bouderbela.exe, PE32 25->69 dropped 71 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 25->71 dropped 73 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 25->73 dropped 75 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 25->75 dropped 38 Bouderbela.exe 25->38         started        127 s3.pl-waw.scw.cloud 151.115.10.1, 443, 49778, 49779 OnlineSASFR United Kingdom 29->127 129 baganda.s3.pl-waw.scw.cloud 29->129 77 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 29->77 dropped 79 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 29->79 dropped 81 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 29->81 dropped 83 C:\Users\user\AppData\...\Bouderbela.exe, PE32 29->83 dropped 43 Bouderbela.exe 29->43         started        163 Multi AV Scanner detection for dropped file 31->163 165 Machine Learning detection for dropped file 31->165 167 Tries to harvest and steal browser information (history, passwords, etc) 31->167 131 192.168.2.1 unknown unknown 34->131 file14 signatures15 process16 dnsIp17 107 s3.pl-waw.scw.cloud 38->107 109 hammajawa7dou.s3.nl-ams.scw.cloud 38->109 111 baganda.s3.pl-waw.scw.cloud 38->111 45 C:\Users\user\AppData\...behaviorgraphipucineno.exe, PE32 38->45 dropped 47 C:\Users\user\AppData\...47iraedyzhehae.exe, PE32 38->47 dropped 49 C:\Program Files (x86)\...\Kugumyjilu.exe, PE32 38->49 dropped 57 3 other malicious files 38->57 dropped 141 Antivirus detection for dropped file 38->141 143 Machine Learning detection for dropped file 38->143 113 360devtracking.com 37.230.138.66, 80 ROCKETTELECOM-ASRU Russian Federation 43->113 115 s3.nl-ams.scw.cloud 163.172.208.8, 443, 49796, 49808 OnlineSASFR United Kingdom 43->115 117 4 other IPs or domains 43->117 51 C:\Users\user\AppData\...\Derytejudae.exe, PE32 43->51 dropped 53 C:\Users\user\AppData\...\Paraecefyhe.exe, PE32 43->53 dropped 55 C:\Program Files (x86)\...\Cosaeqasobe.exe, PE32 43->55 dropped 59 3 other malicious files 43->59 dropped file18 signatures19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f61c7d939ea77fff7eb409522338347b140beb1c5977bd0fc84ff301dd31605/
Threat name:
Win32.Backdoor.Zapchast
Create hunting rule
Status:
Malicious
First seen:
2021-12-21 12:17:12 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b5q4pwjz5j37757licksem4di6yubpvrywlxxuh4qt7tahotcycq._file
Verdict:
malicious
Label(s):
ryuk
Create hunting rule
Similar samples:
045480a084a090029c9f86b103e3f23b4e9e3923180c35d61eca933af3802060
CoinMiner.XMRig
33330133ac2e1b2dfcbc12b66276a6a61f4c4572ad4de8675f8afdabfcbb3d43
CoinMiner.XMRig
4fe1cb64f16f7fa987407a906a4319520972f5a8f5749e3b071a831825559a45
CoinMiner.XMRig
7d11586c00eeb3c5a62f8924e862f4926e5c0632b1eb9e95008d91a5f689b1eb
CoinMiner.XMRig
98b744289399d40bee96ceada3e8a187627ca9d09e4815078b83762ae78cedfb
CoinMiner.XMRig
a2f9f5a099a6b1c2ba6789effefa150aec52c5587e85df9a6963fd03b55d4d57
CoinMiner.XMRig
+ 615 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion spyware stealer suricata trojan
Link:
https://tria.ge/reports/211221-pf2daaebhr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Defender Real-time Protection settings
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
Unpacked files
SH256 hash:
0f61c7d939ea77fff7eb409522338347b140beb1c5977bd0fc84ff301dd31605
MD5 hash:
4edbae4f41dbfff3675a867fe06ea0db
SHA1 hash:
f6e91d1e642b7e9762b0ecc2e36b6fc489da4a13
Link:
https://www.unpac.me/results/b1e9f94a-532d-4e91-9cb5-4bf2387825b0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0f61c7d939ea77fff7eb409522338347b140beb1c5977bd0fc84ff301dd31605

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_DLInjector06
Create hunting rule
Author:ditekSHen
Description:Detects downloader / injector

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner.XMRig

Executable exe 0f61c7d939ea77fff7eb409522338347b140beb1c5977bd0fc84ff301dd31605

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1799095/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/215647/

Comments