MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19cc0288ccee01a7dfe099b9fa5eb6ec2862cadc5485b0ad9ad19a2d4a2ee2ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19cc0288ccee01a7dfe099b9fa5eb6ec2862cadc5485b0ad9ad19a2d4a2ee2ac
SHA3-384 hash: 20b5e0b0fc71a35f9702fc342392a54376450cae6b611c465f96274b3828a83007bf3121ef37cb7e81ea101a074d36f7
SHA1 hash: 97ddcfa278d542559dafe01896946eea464bbe47
MD5 hash: d547b2204c84d001bd1c219699616cde
humanhash: tennessee-triple-mockingbird-summer
File name:d547b2204c84d001bd1c219699616cde
Download: download sample
Signature CoinMiner
Create hunting rule
File size:2'052'322 bytes
First seen:2021-11-19 17:24:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 02549ff92b49cce693542fc9afb10102 (84 x CoinMiner, 2 x CoinMiner.XMRig, 1 x AgentTesla)
ssdeep 49152:9jZPYdDZPBHMWy8SYuMwc8YzzCkO7Du7lNXNi8U5zD9QabN0K:DaP6Wy8JwcDzOvu5NdiDdG20
Threatray 264 similar samples on MalwareBazaar
TLSH T1E19533639E95930CF87C1133B0820D02AB943B5185E0F31D6CCA5BB9657AEB5EFA0D9D
Reporter zbetcheckin
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
194
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d547b2204c84d001bd1c219699616cde
Verdict:
No threats detected
Analysis date:
2021-11-19 17:36:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/31c47869-23e0-461e-a192-1bc6526ec510

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
Win.Malware.Generickdz-9909539-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Creating a process from a recently created file
Creating a process with a hidden window
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
donut overlay packed
Link:
https://www.filescan.io/uploads/6197ddf243e8f62b669ab162/reports/1b41f2e0-f21d-4921-b286-621b7dff81c1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0185c76c-234c-4609-89eb-4e96673355d5
Result
Threat name:
BitCoin Miner
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/892826
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Drops PE files to the user root directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected BitCoin Miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 525299 Sample: 0IFR5OXa5w Startdate: 19/11/2021 Architecture: WINDOWS Score: 84 46 Multi AV Scanner detection for submitted file 2->46 48 Yara detected BitCoin Miner 2->48 9 0IFR5OXa5w.exe 2->9         started        12 services32.exe 2->12         started        process3 signatures4 60 Writes to foreign memory regions 9->60 62 Allocates memory in foreign processes 9->62 64 Creates a thread in another existing process (thread injection) 9->64 14 conhost.exe 5 9->14         started        66 Multi AV Scanner detection for dropped file 12->66 18 conhost.exe 5 12->18         started        process5 file6 40 C:\Users\user\services32.exe, PE32+ 14->40 dropped 42 C:\Users\...\services32.exe:Zone.Identifier, ASCII 14->42 dropped 74 Drops PE files to the user root directory 14->74 20 cmd.exe 1 14->20         started        22 cmd.exe 1 14->22         started        44 C:\Users\user\AppData\...\sihost32.exe, PE32+ 18->44 dropped 25 sihost32.exe 18->25         started        signatures7 process8 signatures9 27 services32.exe 20->27         started        30 conhost.exe 20->30         started        50 Uses schtasks.exe or at.exe to add and modify task schedules 22->50 32 conhost.exe 22->32         started        34 schtasks.exe 1 22->34         started        52 Multi AV Scanner detection for dropped file 25->52 54 Writes to foreign memory regions 25->54 56 Allocates memory in foreign processes 25->56 58 Creates a thread in another existing process (thread injection) 25->58 36 conhost.exe 2 25->36         started        process10 signatures11 68 Writes to foreign memory regions 27->68 70 Allocates memory in foreign processes 27->70 72 Creates a thread in another existing process (thread injection) 27->72 38 conhost.exe 2 27->38         started        process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19cc0288ccee01a7dfe099b9fa5eb6ec2862cadc5485b0ad9ad19a2d4a2ee2ac/
Threat name:
Win64.Trojan.Donut
Create hunting rule
Status:
Malicious
First seen:
2021-11-19 17:25:05 UTC
AV detection:
20 of 45 (44.44%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0221c396bd17917621bb6bd04a09a07e5e00389c25677bb3af7170cb858a9ea4
CoinMiner
03a3d447adee0253b7a8671ef4051100a4fa366df453cb96c08a7bd76788d11d
CoinMiner
67ad7348d5bfbb13a98697962b46a7a833137b636b49c6eac2829c2d425e9dfa
CoinMiner
8211e981afb4ef075c4d398d21b89ee1a2e1e559b139c9d2310d97cf5303cf73
CoinMiner
86ae354a12341fd3def17aacee3e3ee3bf9678c499cbb81f0db1014177f378dd
CoinMiner
9b0de4434ee36e29881a3667164eaf04158c0c1256f74331074117d96693c6d3
CoinMiner
d3971de408a80057671d1f39dd0aafcb4501903b6c9cf7f5fb51fffc0ab43599
CoinMiner
d3f77ae659c38c08c8c39fde6c8e5900817e2032b5b8e96de98811b00889b486
CoinMiner
d8ce2e5613b91a46eb15835e6d2aac47a715e2ab55a97163bdf2ed8ac350f7a1
CoinMiner
f3580c945b60d9f9b43c886f0f86244308c4ec859b6b3e005e5ebc2315ff0f0b
CoinMiner
+ 254 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/211119-vy912aeag4/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
19cc0288ccee01a7dfe099b9fa5eb6ec2862cadc5485b0ad9ad19a2d4a2ee2ac
MD5 hash:
d547b2204c84d001bd1c219699616cde
SHA1 hash:
97ddcfa278d542559dafe01896946eea464bbe47
Link:
https://www.unpac.me/results/3ee4e76a-5801-4378-9390-507b00959d5a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/19cc0288ccee/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/19cc0288ccee01a7dfe099b9fa5eb6ec2862cadc5485b0ad9ad19a2d4a2ee2ac

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 19cc0288ccee01a7dfe099b9fa5eb6ec2862cadc5485b0ad9ad19a2d4a2ee2ac

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/207655/

Comments