MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fa34c4fc0ec5810af33c51465647aa5f90654273f3e0756325c8d4817b17a64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 12

Intelligence 12 IOCs YARA 22 File information Comments

SHA256 hash:	2fa34c4fc0ec5810af33c51465647aa5f90654273f3e0756325c8d4817b17a64
SHA3-384 hash:	4244e3417b86374c03fb6d0b63ddeb8de3194663a9f1e10c886ce79e5aa8a257fbf111d79a1d65556c41944b3cde497f
SHA1 hash:	b01973c7a4633ed33846b059993544f55918733d
MD5 hash:	06b592fef39a6c6f5f816d27a361ce80
humanhash:	venus-moon-tennis-beer
File name:	GoogleCrashHandler.exe
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	6'997'504 bytes
First seen:	2023-11-28 15:05:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5e5ac8ab7be27ac2d1c548e5589378b6 (11 x GuLoader, 6 x Stealc, 5 x RedLineStealer)
ssdeep	196608:t0fYlDLhGN/9GkZV4DlJl32ZyttwecirJi:tIYlDLhg1GkZVGljcirw
Threatray	1 similar samples on MalwareBazaar
TLSH	T1086633D8532B1E96F81EAB7C8D971F87134B6FEAA68D53F8719CB1204703E5B412017A
TrID	34.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 23.4% (.EXE) Win32 Executable (generic) (4505/5/1) 10.7% (.EXE) Win16/32 Executable Delphi generic (2072/23) 10.5% (.EXE) OS/2 Executable (generic) (2029/13) 10.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	Xev
Tags:	CoinMiner CoinMiner.XMRig exe GuLoader

NIXLovesCooper

https://s3.us-east-1.amazonaws.com/010ad332/GoogleCrashHandler.exe

Intelligence

File Origin

# of uploads :

# of downloads :

355

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/460964/

Detection(s):

Win.Malware.Agen-9821312-0

PUA.Win.Packer.EnigmaProtector-9852682-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file in the %temp% directory

Searching for analyzing tools

Enabling the 'hidden' option for files in the %temp% directory

Running batch commands

Creating a process with a hidden window

Launching a process

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

Creating a process from a recently created file

DNS request

Connecting to a cryptocurrency mining pool

Sending a custom TCP request

Creating a service

Launching a service

Loading a system driver

Enabling autorun for a service

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin packed shell32

Link:

https://www.filescan.io/uploads/656601de7485e5b1ecbeaa9f/reports/1408711e-e345-4f04-bb87-f8f41c2aa9f9/overview

Verdict:

Malicious

Labled as:

Jaik.Generic

Link:

https://www.hybrid-analysis.com/sample/2fa34c4fc0ec5810af33c51465647aa5f90654273f3e0756325c8d4817b17a64

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Spark

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a589f994-7bf2-4db2-b7cb-79424be4984a

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/2fa34c4fc0ec5810af33c51465647aa5f90654273f3e0756325c8d4817b17a64

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2fa34c4fc0ec5810af33c51465647aa5f90654273f3e0756325c8d4817b17a64/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2023-11-26 14:41:19 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 23 (86.96%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f6ruyt6a5rmbblztyukgkzd2ux4qmvbhh47aovrslsguqf5rpjsa._file

Verdict:

suspicious

CoinMiner

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig miner

Link:

https://tria.ge/reports/231128-sgqjysah5x/

Behaviour

Delays execution with timeout.exe

Enumerates processes with tasklist

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Executes dropped EXE

Loads dropped DLL

XMRig Miner payload

xmrig

Unpacked files

SH256 hash:

9b9be81fa7f1064fa8be5b31d345f0ccb4d039e9780f7db318803773ca65b004

MD5 hash:

f474d72ad7ffdd18cc6c73a0c4d5e840

SHA1 hash:

138948aa6132b49bf4a48adf7c5c817f5884555f

Link:

https://www.unpac.me/results/4d3a4b1f-ff27-4036-8afa-c0975b7eb5ae/

SH256 hash:

2fa34c4fc0ec5810af33c51465647aa5f90654273f3e0756325c8d4817b17a64

MD5 hash:

06b592fef39a6c6f5f816d27a361ce80

SHA1 hash:

b01973c7a4633ed33846b059993544f55918733d

Link:

https://www.unpac.me/results/4d3a4b1f-ff27-4036-8afa-c0975b7eb5ae/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2fa34c4fc0ec5810af33c51465647aa5f90654273f3e0756325c8d4817b17a64

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	EnigmaStub Create hunting rule
Author:	@bartblaze
Description:	Identifies Enigma packer stub.

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RC6_Constants Create hunting rule
Author:	chort (@chort0)
Description:	Look for RC6 magic constants in binary
Reference:	https://twitter.com/mikko/status/417620511397400576

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

exe 3aaeda2f9d9086b9960c4d19e18fbd3b0033de7fc43dbf3b647f70a9ac0926f2

CoinMiner

exe 2fa34c4fc0ec5810af33c51465647aa5f90654273f3e0756325c8d4817b17a64

(this sample)

Dropped by

SHA256 3aaeda2f9d9086b9960c4d19e18fbd3b0033de7fc43dbf3b647f70a9ac0926f2

Cape

https://www.capesandbox.com/analysis/460964/

URLhaus

https://urlhaus.abuse.ch/url/2736197/

Delivery method

Distributed via web download

Dropped by

MD5 cab9ec528dab8361797680046e26a13a

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample