MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27534f1412396fe898ff5eb25143468b21b0358d157f7a82f54fc61897296960. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27534f1412396fe898ff5eb25143468b21b0358d157f7a82f54fc61897296960
SHA3-384 hash: 503ff15c150191303a4d66f3c31c55024d0b3415c5a1d7a026bcc16f1f74300b63db6fe76ec417042ec610adec28385a
SHA1 hash: 6201ba1c2d372bee9939529a9647ecba1752a8ac
MD5 hash: 448192390a65b9cffaf11d40b5e9ac7b
humanhash: march-glucose-robin-stairway
File name:chrome.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:6'220'568 bytes
First seen:2023-06-25 02:26:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f7505c167603909b7180406402fef19e (36 x CoinMiner, 3 x PripyatMiner)
ssdeep 98304:fRKSIpbX1haCVfGdxBjLwH9xR59xgRUICMchthBjqVa:fMSIpbX1YIfADnm9xT9xgRFQqa
Threatray 29 similar samples on MalwareBazaar
TLSH T16756D1C04C0A553DCF9387775EFB7D41798D980BA83763BF55AB976E09A70482AC3822
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 30f8d0c8c8c0e030 (1 x RedLineStealer, 1 x CoinMiner, 1 x QuasarRAT)
Reporter Chainskilabs
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
328
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
chrome.exe
Verdict:
Malicious activity
Analysis date:
2023-06-25 02:27:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/76ff1120-1a03-4958-97e1-3d16f283a15f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/402503/
Detection(s):
SecuriteInfo.com.Variant.Barys.429302.1179.5058.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Launching a process
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/92574/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug overlay packed
Link:
https://www.filescan.io/uploads/6497a5f7ee55f1e1b4b538ad/reports/1d70be37-ec69-4126-9b7f-1a9dba0f4922/overview
Verdict:
Malicious
Labled as:
Barys.Generic
Link:
https://www.hybrid-analysis.com/sample/27534f1412396fe898ff5eb25143468b21b0358d157f7a82f54fc61897296960
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b1d4713d-8f11-4847-9b1c-8771bf86a6d3
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
spyw.expl.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1260955
Signature
Found hidden mapped module (file has been removed from disk)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects code into the Windows Explorer (explorer.exe)
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Snort IDS alert for network traffic
Suspicious execution chain found
System process connects to network (likely due to code injection or exploit)
Uses powercfg.exe to modify the power settings
Writes to foreign memory regions
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 893975 Sample: chrome.exe Startdate: 25/06/2023 Architecture: WINDOWS Score: 100 50 Snort IDS alert for network traffic 2->50 52 Malicious sample detected (through community Yara rule) 2->52 54 Multi AV Scanner detection for dropped file 2->54 56 3 other signatures 2->56 6 updater.exe 4 2->6         started        10 cmd.exe 1 2->10         started        12 chrome.exe 3 2->12         started        14 7 other processes 2->14 process3 file4 36 C:\Users\user\AppData\Roaming\...\WR64.sys, PE32+ 6->36 dropped 38 C:\Users\user\AppData\...\yveyjachktpe.tmp, PE32+ 6->38 dropped 58 Multi AV Scanner detection for dropped file 6->58 60 Injects code into the Windows Explorer (explorer.exe) 6->60 62 Writes to foreign memory regions 6->62 70 4 other signatures 6->70 16 explorer.exe 6->16         started        20 conhost.exe 6->20         started        64 Uses powercfg.exe to modify the power settings 10->64 66 Modifies power options to not sleep / hibernate 10->66 22 conhost.exe 10->22         started        24 powercfg.exe 1 10->24         started        32 3 other processes 10->32 40 C:\Users\user\AppData\Roaming\...\updater.exe, PE32+ 12->40 dropped 68 Suspicious execution chain found 12->68 26 conhost.exe 14->26         started        28 conhost.exe 14->28         started        30 conhost.exe 14->30         started        34 11 other processes 14->34 signatures5 process6 dnsIp7 42 vhstwqbift.loophole.site 138.201.126.72, 443, 49699, 49701 HETZNER-ASDE Germany 16->42 44 pool.hashvault.pro 95.179.241.203, 49698, 49700, 80 AS-CHOOPAUS Netherlands 16->44 46 System process connects to network (likely due to code injection or exploit) 16->46 48 Query firmware table information (likely to detect VMs) 16->48 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27534f1412396fe898ff5eb25143468b21b0358d157f7a82f54fc61897296960/
Threat name:
Win64.Trojan.Barys
Create hunting rule
Status:
Malicious
First seen:
2023-06-24 16:27:10 UTC
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e5ju6fashfx6rgh7l2zfcq2grmq3anmncv7xvaxvj7dbrfzjnfqa._file
Verdict:
malicious
Similar samples:
19aedf2b14d90e4cf5df0a8d533b1b9024ffa46ed56434ddc5d0ebcaec2487e9
CoinMiner
3dbfc85922adcc72d86d8c50d0e027efeb71bc9b0b4f8c7bba7be5348a7d0d5d
CoinMiner
54c7a21de074152b11a9aefb278508706176189c322c08fc2e56fec1a7f9169b
CoinMiner
ac3af6bd3139c444e8e146a6d48c110ae33c09d23c84b7b02f3d7af9eaa49c84
CoinMiner
d540f75897495102dd30eaa924623ac40415e8a716bdcbadf7d7c9a00feb5c97
CoinMiner
e0e267a1da22b796f4f8a7b84a81d0f0a461183cdc03d267a75e34d9fc497ccd
CoinMiner
e5144397e6dedc2ecd83322530aa758043bf4de92b8737a94a41b8e4e2103f4e
CoinMiner
e5ec05d1f59933949c166e82457c251e49146bb42bc4b9017a9fc625c6a13dff
CoinMiner
ecd60313ba990f1300b37db4064977e83f109fdf93a728cf434106c1b5b5a2d5
CoinMiner
+ 19 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig miner
Link:
https://tria.ge/reports/230625-cxevdsda27/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Drops file in System32 directory
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
XMRig Miner payload
Suspicious use of NtCreateUserProcessOtherParentProcess
xmrig
Unpacked files
SH256 hash:
27534f1412396fe898ff5eb25143468b21b0358d157f7a82f54fc61897296960
MD5 hash:
448192390a65b9cffaf11d40b5e9ac7b
SHA1 hash:
6201ba1c2d372bee9939529a9647ecba1752a8ac
Link:
https://www.unpac.me/results/d48bb49b-edb9-48c4-a909-51aabe51c9aa/
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/27534f141239/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/27534f1412396fe898ff5eb25143468b21b0358d157f7a82f54fc61897296960

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 27534f1412396fe898ff5eb25143468b21b0358d157f7a82f54fc61897296960

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/402503/

Comments