MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25d08c4963813d33d518d48f357079ccc6ddc28516cbcab1838efc2f55ed712b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 10


Intelligence 10 IOCs 3 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 25d08c4963813d33d518d48f357079ccc6ddc28516cbcab1838efc2f55ed712b
SHA3-384 hash: 567648bc127eff1761ead3a7521772efe89ae39a8f75209d595e99468fa22349915b535de400b32fa032670d4c598a0e
SHA1 hash: 50b03a063fb7b27ac5a2ea4b3de4145b7b6968d0
MD5 hash: 820d8fa4cc577a0c3d80b629ee9584eb
humanhash: tennis-iowa-wyoming-eighteen
File name:820d8fa4cc577a0c3d80b629ee9584eb.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:131'072 bytes
First seen:2021-09-27 15:37:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f98cc9327e2d65cc6189a693f26e1c1d (5 x ArkeiStealer, 4 x RaccoonStealer, 3 x RedLineStealer)
ssdeep 1536:CDOCZw1YLUlPtZPboPq0CYkN/y2VKz1KZn/ZQeh3uJp+Q7Jgz70FiAfT4Xz:C/wcU/ZPboCjdraKd/ZXqfPtCz
Threatray 6'837 similar samples on MalwareBazaar
TLSH T159D3CF24BCE0D572D3471532483BCAF55A3FBA310F3196673769260F0EB12E996263A7
File icon (PE):PE icon
dhash icon 4839b234e8c38890 (121 x RaccoonStealer, 54 x RedLineStealer, 51 x ArkeiStealer)
Reporter abuse_ch
Tags:CoinMiner exe


Avatar
abuse_ch
CoinMiner C2:
185.92.74.142:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.92.74.142:80 https://threatfox.abuse.ch/ioc/227056/
45.144.29.94:61419 https://threatfox.abuse.ch/ioc/227085/
92.246.89.6:38437 https://threatfox.abuse.ch/ioc/226920/

Intelligence

File Origin
# of uploads :
1
# of downloads :
251
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
820d8fa4cc577a0c3d80b629ee9584eb.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-27 15:40:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/dea7c941-456d-4810-8681-36b5d56f7abc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/192182/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.15821.2496.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1fb9bc34-e713-4b62-be35-25505f97c357
Result
Threat name:
Raccoon RedLine SmokeLoader Tofsee
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/859122
Signature
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
May check the online IP address of the machine
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Obfuscated command line found
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Sigma detected: Copying Sensitive Files with Credential Data
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Uses known network protocols on non-standard ports
Uses netsh to modify the Windows network and firewall settings
Uses ping.exe to check the status of other devices and networks
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 491556 Sample: kzSWxYLY4H.exe Startdate: 27/09/2021 Architecture: WINDOWS Score: 100 57 194.180.174.100, 49831, 80 MIVOCLOUDMD unknown 2->57 59 t.me 149.154.167.99, 443, 49821 TELEGRAMRU United Kingdom 2->59 61 9 other IPs or domains 2->61 69 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->69 71 Antivirus detection for URL or domain 2->71 73 Yara detected SmokeLoader 2->73 75 15 other signatures 2->75 10 kzSWxYLY4H.exe 2->10         started        13 gejcfub 2->13         started        15 svchost.exe 1 2->15         started        17 3 other processes 2->17 signatures3 process4 signatures5 93 Detected unpacking (changes PE section rights) 10->93 95 Contains functionality to inject code into remote processes 10->95 97 Injects a PE file into a foreign processes 10->97 19 kzSWxYLY4H.exe 10->19         started        99 Multi AV Scanner detection for dropped file 13->99 22 gejcfub 13->22         started        process6 signatures7 77 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 19->77 79 Maps a DLL or memory area into another process 19->79 81 Checks if the current machine is a virtual machine (disk enumeration) 19->81 83 Creates a thread in another existing process (thread injection) 19->83 24 explorer.exe 12 19->24 injected process8 dnsIp9 63 216.128.137.31, 80 AS-CHOOPAUS United States 24->63 65 privacy-toolz-for-you-403.top 194.147.85.186, 49750, 49752, 49753 NETRACK-ASRU Russian Federation 24->65 67 11 other IPs or domains 24->67 49 C:\Users\user\AppData\Roaming\gejcfub, PE32 24->49 dropped 51 C:\Users\user\AppData\Local\Temp\A7DA.exe, PE32 24->51 dropped 53 C:\Users\user\AppData\Local\Temp\95A9.exe, PE32 24->53 dropped 55 4 other malicious files 24->55 dropped 101 System process connects to network (likely due to code injection or exploit) 24->101 103 Benign windows process drops PE files 24->103 105 Deletes itself after installation 24->105 107 Hides that the sample has been downloaded from the Internet (zone.identifier) 24->107 29 5FC6.exe 24->29         started        32 789F.exe 3 24->32         started        34 95A9.exe 3 24->34         started        36 2 other processes 24->36 file10 signatures11 process12 signatures13 109 Multi AV Scanner detection for dropped file 29->109 111 Detected unpacking (changes PE section rights) 29->111 113 Injects a PE file into a foreign processes 29->113 38 5FC6.exe 29->38         started        115 Query firmware table information (likely to detect VMs) 32->115 117 Hides threads from debuggers 32->117 119 Tries to detect sandboxes / dynamic malware analysis system (registry check) 32->119 41 conhost.exe 32->41         started        121 Tries to detect sandboxes and other dynamic analysis tools (window names) 34->121 123 Machine Learning detection for dropped file 34->123 43 conhost.exe 34->43         started        125 Antivirus detection for dropped file 36->125 127 Detected unpacking (overwrites its own PE header) 36->127 45 69BA.exe 2 36->45         started        47 conhost.exe 36->47         started        process14 signatures15 85 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 38->85 87 Maps a DLL or memory area into another process 38->87 89 Checks if the current machine is a virtual machine (disk enumeration) 38->89 91 Creates a thread in another existing process (thread injection) 38->91
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/25d08c4963813d33d518d48f357079ccc6ddc28516cbcab1838efc2f55ed712b/
Threat name:
Win32.Trojan.Racealer
Create hunting rule
Status:
Malicious
First seen:
2021-09-27 15:38:17 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=exiiysldqe6thviy2shtk4dzztdn3qufc3f4vmmdr36c6vpnoevq._file
Verdict:
malicious
Similar samples:
39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b
CoinMiner
467425771038209d08868a51e6bbb8834fa53a33762f15818bd9905f5663828a
CoinMiner
5758800ba2a45f64a6cf7f011159fb521eeacbd18c441adf2748690eee7faa00
CoinMiner
5ed39b2c2b58db059b65bd11c6783a1c65b9836143f2c4dfbde502ff685598db
CoinMiner
674006b8cf885bb27c186c2ef23ee6b9b5b9894985b909021eebcaccb74d6845
CoinMiner
8350538160b089becbb7142d16ecf8089b16fbf11ead40dc1169a9e6104c0304
CoinMiner
843140b0a3f095d74fe2682d3ae029d4da70a5bae79850cf047a72c9d4a882c0
CoinMiner
89bad428ef1f3d8d2217fa8fbf5421824383232f60c1d72fb4ad80ee0c56663f
CoinMiner
e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cfbf9fc9ed24d8dc7d143
CoinMiner
f9edbff29a53d95b7eb874b4db8cc83cae6c61f8c7e1d79176d68bf09a842167
CoinMiner
+ 6'827 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/210927-s25jlshddm/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Deletes itself
Executes dropped EXE
SmokeLoader
Malware Config
C2 Extraction:
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
Unpacked files
SH256 hash:
2fead9437f15e057951fd6a02ab05076e38db13483df0191787c21c79343b9e7
MD5 hash:
1c90f3a3fcd93ee08b2154cbcff49085
SHA1 hash:
73ac881633a13c3c31c1153d8105b8ecbb60961e
Link:
https://www.unpac.me/results/c476283b-f475-4d41-9cfd-24900b059a7e/
SH256 hash:
25d08c4963813d33d518d48f357079ccc6ddc28516cbcab1838efc2f55ed712b
MD5 hash:
820d8fa4cc577a0c3d80b629ee9584eb
SHA1 hash:
50b03a063fb7b27ac5a2ea4b3de4145b7b6968d0
Link:
https://www.unpac.me/results/c476283b-f475-4d41-9cfd-24900b059a7e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/25d08c496381/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/25d08c4963813d33d518d48f357079ccc6ddc28516cbcab1838efc2f55ed712b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 25d08c4963813d33d518d48f357079ccc6ddc28516cbcab1838efc2f55ed712b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1639930/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/192182/

Comments