MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 34ab005b549534dba9a83d9346e1618a18ecee2c99a93079551634f9480b2b79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
CoinMiner
Vendor detections: 15
| SHA256 hash: | 34ab005b549534dba9a83d9346e1618a18ecee2c99a93079551634f9480b2b79 |
|---|---|
| SHA3-384 hash: | 7e0146d849e0e25f3e69d6294ee3c714b8851c985821cf256908005a5f33712aa0ada18dd20efe3b69727719321588dc |
| SHA1 hash: | 247b5c812136a40f85c106ca6441315b123f625e |
| MD5 hash: | f9e4ae00290e5259c78ba11b4c851417 |
| humanhash: | vegan-twenty-freddie-november |
| File name: | GXBuilder.exe |
| Download: | download sample |
| Signature | CoinMiner |
| File size: | 13'190'144 bytes |
| First seen: | 2024-01-22 20:33:07 UTC |
| Last seen: | 2024-04-27 07:03:52 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 6f462fcc6b830b77fb3fef2add9dc570 (9 x CoinMiner, 3 x BitRAT, 2 x XWorm) |
| ssdeep | 196608:/i76SDEa0mOCb5xm4J15iY5XBx9vjnWmf58eOt6dp2wGSECksB579u5gnynV:/imJa0mN/p1599vjnXVd9pl5Ggn |
| Threatray | 173 similar samples on MalwareBazaar |
| TLSH | T1F0D6330E6A4E07D4E6FA77319FA8C87407C15D7A504D79D50CF08CA77EE916BA320A2B |
| TrID | 38.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 15.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 11.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.5% (.EXE) Win32 Executable (generic) (4505/5/1) 4.8% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| File icon (PE): |  |
| dhash icon | 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer) |
| Reporter |  e24111111111111 |
| Tags: | CoinMiner Crysan exe PureCrypt XenoRAT zgRAT |
Intelligence
File Origin
# of uploads :
3
# of downloads :
375
Origin country :
GRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
GXImageLogger.zip
Verdict:
Malicious activity
Analysis date:
2024-01-20 11:18:44 UTC
Tags:
xenorat rat
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% directory
Creating a file
Deleting a system file
Running batch commands
Unauthorized injection to a recently created process
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
FakeAlert.Generic
Result
Verdict:
MALICIOUS
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
XenoRAT, Xmrig
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Changes security center settings (notifications, updates, antivirus, firewall)
Creates files with lurking names (e.g. Crack.exe)
Encrypted powershell cmdline option found
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Potential dropper URLs found in powershell memory
Sample is not signed and drops a device driver
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected XenoRAT
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Score:
99%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Nekark
Status:
Malicious
First seen:
2024-01-10 07:09:52 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
27 of 38 (71.05%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 163 additional samples on MalwareBazaar
Result
Malware family:
zgrat
Score:
10/10
Tags:
family:zgrat evasion persistence pyinstaller rat
Behaviour
Creates scheduled task(s)
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Detects Pyinstaller
Enumerates physical storage devices
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Creates new service(s)
Stops running service(s)
Detect ZGRat V1
ZGRat
Unpacked files
SH256 hash:
7cae509e975b80307e06568b3c1ee1d1bee72c0b4bac104dccac1455ab4e19eb
MD5 hash:
fd01efbfead9b5db6fffa1f56bad04c3
SHA1 hash:
19f236dab1daf7c49f11c5fb55cc5d3edd4c56fe
SH256 hash:
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db
MD5 hash:
e004a568b841c74855f1a8a5d43096c7
SHA1 hash:
b90fd74593ae9b5a48cb165b6d7602507e1aeca4
SH256 hash:
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e
MD5 hash:
d499e979a50c958f1a67f0e2a28af43d
SHA1 hash:
1e5fa0824554c31f19ce01a51edb9bed86f67cf0
SH256 hash:
34ab005b549534dba9a83d9346e1618a18ecee2c99a93079551634f9480b2b79
MD5 hash:
f9e4ae00290e5259c78ba11b4c851417
SHA1 hash:
247b5c812136a40f85c106ca6441315b123f625e
Malware family:
XMRig
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.