MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 201fb376d18d216baf555ff6afdc0754f94c4475ceaf3b5c713473833cc60aa5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	201fb376d18d216baf555ff6afdc0754f94c4475ceaf3b5c713473833cc60aa5
SHA3-384 hash:	508ab12866742f3ba71261ee56cc1c579e9b771f0cf9f12c4d12e55570f38f4724dacc7c25c88b489d0ea390ff7ed6a7
SHA1 hash:	36e3c72d06975bbf8275f96a9978be4faa6a7848
MD5 hash:	91d04346e7f17b8e2aae64d27f042adc
humanhash:	vermont-kitten-mango-timing
File name:	yljlbesdmoas.exe
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	2'650'624 bytes
First seen:	2023-12-01 20:49:34 UTC
Last seen:	2023-12-01 22:21:34 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	de41d4e0545d977de6ca665131bb479a (85 x CoinMiner)
ssdeep	49152:knvVwOy5ObqmiB9hWGw54UYmbRx+USKVCZjOypc9cofHWJ/pviFkO:kGx5myXWGIYmbRxBS5jOyq9cofHWJRlO
Threatray	10 similar samples on MalwareBazaar
TLSH	T181C533835B980A61E47D0673A8CF6825B44C6CC14F94F8DF64E1B3C499216EA5DF8ECB
TrID	49.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 31.8% (.EXE) Win64 Executable (generic) (10523/12/4) 6.1% (.EXE) OS/2 Executable (generic) (2029/13) 6.0% (.EXE) Generic Win/DOS Executable (2002/3) 6.0% (.EXE) DOS Executable Generic (2000/1)
Reporter	smica83
Tags:	CoinMiner exe HUN XMRIG

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

372

Origin country :

HU

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

yljlbesdmoas.exe

Verdict:

Malicious activity

Analysis date:

2023-12-01 20:53:16 UTC

Tags:

miner

Link:

https://app.any.run/tasks/69991d88-9a24-4800-8369-bb87484569c6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/461815/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win64.Evo-gen.4176.25565.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

Running batch commands

Deleting a system file

Launching a process

Creating a service

Creating a file

Launching a service

Creating a process from a recently created file

Creating a file in the Windows subdirectories

Searching for synchronization primitives

Creating a file in the system32 subdirectories

DNS request

Connecting to a cryptocurrency mining pool

Sending a custom TCP request

Loading a system driver

Enabling autorun for a service

Adding an exclusion to Microsoft Defender

Unauthorized injection to a system process

Dragonfly

Gathering data

Hybrid Analysis Zusy.Generic

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/201fb376d18d216baf555ff6afdc0754f94c4475ceaf3b5c713473833cc60aa5

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8e5a9f0f-f6e6-4d5f-ba86-d83b7506f7ef

Joe Sandbox Xmrig

Result

Threat name:

Xmrig

Alert

Create hunting rule

Detection:

malicious

Classification:

evad.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1351752

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/201fb376d18d216baf555ff6afdc0754f94c4475ceaf3b5c713473833cc60aa5

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/201fb376d18d216baf555ff6afdc0754f94c4475ceaf3b5c713473833cc60aa5/

ReversingLabs TitaniumCloud Win64.Trojan.Zusy

Threat name:

Win64.Trojan.Zusy

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-01 19:50:02 UTC

File Type:

PE+ (Exe)

AV detection:

22 of 36 (61.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eap3g5wrruqwxl2vl73k7xahkt4uyrdvz2xtwxdrgrzygpggbksq._file

Threatray malicious

Verdict:

malicious

Similar samples:

04e3926ce6762b1dc0ce2ea8107a36e9bdda11673ae5b333bccb81a72690a3a1

CoinMiner

0bbfe17f684a3946b76fc48fd788b632cac3ad8b4a60ab6207a35d0d80584758

CoinMiner

9c2d872fbf03c564452ffd898153a5a869a1210ab27212b8d4952ec11e158356

CoinMiner

e380482fc3d8c4fe11073f9734238d60ab66385e3261231358f7d02082b235cd

CoinMiner

Hatching Triage xmrig

Result

Malware family:

xmrig

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xmrig evasion miner persistence upx

Link:

https://tria.ge/reports/231201-zmkn8aga7x/

Behaviour

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Drops file in Windows directory

Launches sc.exe

Drops file in System32 directory

Suspicious use of SetThreadContext

Executes dropped EXE

Loads dropped DLL

UPX packed file

Creates new service(s)

Stops running service(s)

XMRig Miner payload

xmrig

UnpacMe

Unpacked files

SH256 hash:

201fb376d18d216baf555ff6afdc0754f94c4475ceaf3b5c713473833cc60aa5

MD5 hash:

91d04346e7f17b8e2aae64d27f042adc

SHA1 hash:

36e3c72d06975bbf8275f96a9978be4faa6a7848

Link:

https://www.unpac.me/results/94896432-2d62-4b0e-9fa6-3674c7b7ae03/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.40

Link:

https://yomi.yoroi.company/submissions/201fb376d18d216baf555ff6afdc0754f94c4475ceaf3b5c713473833cc60aa5

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/461815/