MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10c0687f586f23c486cb2186667a5edae3bb831ace8a6a9e1c92cb30879e0bf7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	10c0687f586f23c486cb2186667a5edae3bb831ace8a6a9e1c92cb30879e0bf7
SHA3-384 hash:	5148855afd8ec815744d32264b70858292eda8be7b22ce912db57c833f1fe80e828d7e55c339cfa294ede9bf35c8da60
SHA1 hash:	f149c7ba9d6fb6b0a5759fce6a6df419b45b928d
MD5 hash:	d1ae17986d2b258ce218602eb3fc6fd9
humanhash:	blossom-king-kilo-mockingbird
File name:	d1ae17986d2b258ce218602eb3fc6fd9.exe
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	4'750'979 bytes
First seen:	2022-03-28 08:08:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	98304:/RLRLj41OH4wAIOF+kmcIxJr+fx3k/sc37gz+li0pjY3l5x:nj417x3Msc8Kli0JUz
TLSH	T192269E55B2A400E8D9BAC078C64BA917F7F1B8194374ABDB17B052690F23BD06E3FB54
Reporter	abuse_ch
Tags:	CoinMiner exe

Intelligence

File Origin

# of uploads :

# of downloads :

554

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/258495/

Detection(s):

SecuriteInfo.com.PUA.Tool.BtcMine.2622.10988.26926.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/62416ce8a19c6494129e2571/reports/7bbd1f8d-9182-4850-9bbd-a4ea8715b938/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9e10d332-704c-4f49-af38-b290a768903f

Result

Threat name:

Xmrig

Detection:

malicious

Classification:

mine

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/965606

Signature

Found strings related to Crypto-Mining

Multi AV Scanner detection for submitted file

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/10c0687f586f23c486cb2186667a5edae3bb831ace8a6a9e1c92cb30879e0bf7/

Threat name:

Win64.Trojan.Mikey

Status:

Malicious

First seen:

2022-03-28 10:58:15 UTC

AV detection:

12 of 26 (46.15%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cdagq72yn4r4jbwlegdgm6s63lr3xay2z2fgvhq4slftbb46bp3q._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/220328-j1kclsdcfp/

Unpacked files

SH256 hash:

10c0687f586f23c486cb2186667a5edae3bb831ace8a6a9e1c92cb30879e0bf7

MD5 hash:

d1ae17986d2b258ce218602eb3fc6fd9

SHA1 hash:

f149c7ba9d6fb6b0a5759fce6a6df419b45b928d

Link:

https://www.unpac.me/results/50cd04bc-8d7d-4168-9c22-0514dabf0b22/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/10c0687f586f23c486cb2186667a5edae3bb831ace8a6a9e1c92cb30879e0bf7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	rig_win64_xmrig_6_13_1_xmrig Create hunting rule
Author:	yarGen Rule Generator
Description:	rig_win64 - file xmrig.exe
Reference:	https://github.com/Neo23x0/yarGen