MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c758992ed57930115ba585a43bc0a7a750a476206cf1999bf3333f26fc230f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c758992ed57930115ba585a43bc0a7a750a476206cf1999bf3333f26fc230f2
SHA3-384 hash: 4d9a9f46a81c33ee4e97853b3d4cef8ecceab0b9f1a09afacf4a3ee697ee6634f1baff4b4c954da1a06501cf0a4dbf8b
SHA1 hash: e248178106a73dffcfc834f86a0c5f57e994fcb9
MD5 hash: 4aee9140f40798773b516466f397893a
humanhash: harry-carpet-beer-carpet
File name:file.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:3'857'920 bytes
First seen:2023-05-31 02:00:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 49152:YuTiUKYwesC9m4Ysks/YQmd3g9gOa+smNaA5ZbDAIG:
Threatray 405 similar samples on MalwareBazaar
TLSH T11206237257C1BFF9F7654D34D88A2A040DD02FFB969890A8F8C475EBA2B8530D995CB0
TrID 56.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.0% (.ICL) Windows Icons Library (generic) (2059/9)
10.9% (.EXE) OS/2 Executable (generic) (2029/13)
10.7% (.EXE) Generic Win/DOS Executable (2002/3)
10.7% (.EXE) DOS Executable Generic (2000/1)
Reporter Chainskilabs
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
298
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file.exe
Verdict:
Malicious activity
Analysis date:
2023-05-31 02:01:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8c7fc07f-3b15-4f92-bee7-35bf77c9b512

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/393779/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.2064.10626.31007.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Creating a file
Using the Windows Management Instrumentation requests
Forced system process termination
Deleting a recently created file
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
lolbin
Link:
https://www.filescan.io/uploads/6476aa24015beb7a3b05dc29/reports/2bf9ec34-0e4d-474f-a40a-c24dae853b88/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/1c758992ed57930115ba585a43bc0a7a750a476206cf1999bf3333f26fc230f2
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/1d68f3c1-8806-4807-a9cc-7aed57837bfe
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1245704
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Detected Stratum mining protocol
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sigma detected: Xmrig
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 878714 Sample: file.exe Startdate: 31/05/2023 Architecture: WINDOWS Score: 100 55 www.midletpascal.com 2->55 57 xmr.2miners.com 2->57 59 midletpascal.com 2->59 69 Sigma detected: Xmrig 2->69 71 Antivirus / Scanner detection for submitted sample 2->71 73 Multi AV Scanner detection for submitted file 2->73 75 8 other signatures 2->75 9 Value 4 2->9         started        12 file.exe 10 2->12         started        15 powershell.exe 9 2->15         started        17 2 other processes 2->17 signatures3 process4 file5 87 Antivirus detection for dropped file 9->87 89 Multi AV Scanner detection for dropped file 9->89 91 Machine Learning detection for dropped file 9->91 95 3 other signatures 9->95 19 aspnet_compiler.exe 16 5 9->19         started        23 powershell.exe 9->23         started        45 C:\Users\user\AppData\Roaming\...\Value, PE32+ 12->45 dropped 47 C:\Users\...\Drfgpqcdlvhadnmxvnefbshrddr.exe, PE32 12->47 dropped 49 C:\Users\user\...\Value:Zone.Identifier, ASCII 12->49 dropped 51 C:\Users\user\AppData\Local\...\file.exe.log, ASCII 12->51 dropped 93 Encrypted powershell cmdline option found 12->93 25 Drfgpqcdlvhadnmxvnefbshrddr.exe 2 12->25         started        27 powershell.exe 8 12->27         started        29 conhost.exe 15->29         started        31 powershell.exe 17->31         started        signatures6 process7 dnsIp8 61 midletpascal.com 51.89.233.37, 49731, 80 OVHFR France 19->61 63 109.206.240.13, 44810, 49730, 49748 AWMLTNL Germany 19->63 77 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 19->77 79 Encrypted powershell cmdline option found 19->79 81 Writes to foreign memory regions 19->81 85 2 other signatures 19->85 33 AddInProcess.exe 19->33         started        37 powershell.exe 19->37         started        39 conhost.exe 23->39         started        83 Machine Learning detection for dropped file 25->83 41 conhost.exe 27->41         started        signatures9 process10 dnsIp11 53 xmr.2miners.com 162.19.139.184, 2222, 49732 CENTURYLINK-US-LEGACY-QWESTUS United States 33->53 65 Query firmware table information (likely to detect VMs) 33->65 43 conhost.exe 37->43         started        signatures12 67 Detected Stratum mining protocol 53->67 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c758992ed57930115ba585a43bc0a7a750a476206cf1999bf3333f26fc230f2/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-05-31 02:03:27 UTC
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dr2ytexnk6jqcfn2lbnehpakpj2qur3ca3hrtgn7gmz7e36cgdza._file
Verdict:
malicious
Similar samples:
03fcf785b17d2ef8014c2bc90129da267f899218312c789ce94ee24e9a97c105
CoinMiner
18fea28a7191e1812dda7bff13963e571f566705e4f28c321f18fca0231e4a95
CoinMiner
344bfda08e4286ce26dbea13bc9e48892f297e8fb74c1c5eec47a6a2047da3be
CoinMiner
509876bf98ee51fc5d7a4d6af1244227fccd94a556a9c85dd9bdf535d8619b39
CoinMiner
693e7d35129e53a8b686d79ac7e906746cc4fb5ec2806c188028dcd5e8d7164c
CoinMiner
6958b67fa4b8e6b4cb8a503cb6199b81c6df7491a97ec8edf51662e350078fda
CoinMiner
963f054c289e0855e2d119fa2e290bcc3a1d7787c60ed226fb6512b52b3750c5
CoinMiner
965a58fe4566f227649c691d1c3d7c4e3f3f53af2b377d09a5837018a230c811
CoinMiner
ba7eb469fe9c39c9ed627452aa90a74532d8246e493e1b55b3f3ebc079d4583f
CoinMiner
ce64e9ecb6eafed95cc5fbe2b1f7eb84046a6f9cf93c344724fe7052b97a67eb
CoinMiner
+ 395 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig miner
Link:
https://tria.ge/reports/230531-cezrvace24/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
XMRig Miner payload
xmrig
Unpacked files
SH256 hash:
1c758992ed57930115ba585a43bc0a7a750a476206cf1999bf3333f26fc230f2
MD5 hash:
4aee9140f40798773b516466f397893a
SHA1 hash:
e248178106a73dffcfc834f86a0c5f57e994fcb9
Link:
https://www.unpac.me/results/9e7e3289-9323-456c-a764-c4add4937121/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1c758992ed57/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/1c758992ed57930115ba585a43bc0a7a750a476206cf1999bf3333f26fc230f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 1c758992ed57930115ba585a43bc0a7a750a476206cf1999bf3333f26fc230f2

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/393779/

Comments