MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3113000f470106b98b5a3208266c79213a33567ca7841dd1cfe8ab84847c4eb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3113000f470106b98b5a3208266c79213a33567ca7841dd1cfe8ab84847c4eb8
SHA3-384 hash:	0db11d974853739b951978ef9b6daa1bc12d794fb647d4b8733d5991046fff5db15eb50cc9d2fc432040305b27f91a71
SHA1 hash:	46af5182a094fdebf0f5f4faae9d2d11eec11149
MD5 hash:	e5095fd8a247842d03bcc2195bfcf96f
humanhash:	steak-wolfram-social-apart
File name:	test15k2.zip
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	8'192 bytes
First seen:	2023-12-10 09:13:58 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	192:FErBx2hJrBx2hOrBx2hTrBx2hArBx2hIrBx2hNrBx2h4LrBx2hbrBx2hsrBx2hRt:FoihZiheih3ih0ihMihtih4fihvihgiN
TLSH	T17FF1144ABB94F7B1C93E53B2D803F31BD56BC506B33AF6B26C4018BC0A19252A717D19
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	Xev
Tags:	CoinMiner CoinMiner.XMRig Downloader zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

147

Origin country :

GR

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	tesy - Copy (14).bat
File size:	706 bytes
SHA256 hash:	02261a07ff83d906a835ac5229b25595239717e0091f2462804d0a31859bbdc0
MD5 hash:	035f17438f6146d5ac7285b4adfeb370
MIME type:	text/x-msdos-batch
Signature	CoinMiner

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.BAT.Agent.ccl.4247.18666.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

63%

Tags:

cmd powershell

Link:

https://www.filescan.io/uploads/6575815a3f60a810348dfa0c/reports/882d7b34-df22-48c7-bf45-e6d41e417815/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3113000f470106b98b5a3208266c79213a33567ca7841dd1cfe8ab84847c4eb8

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/3113000f470106b98b5a3208266c79213a33567ca7841dd1cfe8ab84847c4eb8

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

Archive

Link:

https://malprob.io/report/3113000f470106b98b5a3208266c79213a33567ca7841dd1cfe8ab84847c4eb8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3113000f470106b98b5a3208266c79213a33567ca7841dd1cfe8ab84847c4eb8/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gejqad2haedltc22giecm3dzee5dgvt4u6cb3uop5cvyjbd4j24a._file

Hatching Triage xmrig

Result

Malware family:

xmrig

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xmrig miner

Link:

https://tria.ge/reports/231210-lfbk3schbj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Executes dropped EXE

Blocklisted process makes network request

XMRig Miner payload

xmrig

Malware Config

Dropper Extraction:

https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3113000f470106b98b5a3208266c79213a33567ca7841dd1cfe8ab84847c4eb8