MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 366b88c9d03a02d78217b6f707a34f7d8592a60b2d08ef66845698c304837de0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 9

Intelligence 9 IOCs YARA 24 File information Comments

SHA256 hash:	366b88c9d03a02d78217b6f707a34f7d8592a60b2d08ef66845698c304837de0
SHA3-384 hash:	7f82ba17cf0b236b0c770ab29a423216d48e971a9e8ba4e33d5be3dc33eadd54c37b893cc940af89a28f6040784ef121
SHA1 hash:	2db04fd1d74e93517b097ab6dc2c73f07906fbcc
MD5 hash:	b644b269e0b8549df0e3781c79243659
humanhash:	cat-fanta-black-moon
File name:	test.zip
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	3'332'014 bytes
First seen:	2023-12-10 10:00:18 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	98304:crB8+Mwef454VqqJ0qEIrhGB57GSI3Mm8fO0z:crBhMI4V3JJqGe5
TLSH	T13AF53396B1348C1ADEC47A2963A76F0387156A651A00E7BFFE00735ACB5B7DCDEC2214
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	Xev
Tags:	CoinMiner CoinMiner.XMRig zip

NIXLovesCooper

https://cdn.nest.rip/uploads/422d676c-8e4d-4d44-a5f3-76537ee06a9c.zip

Intelligence

File Origin

# of uploads :

# of downloads :

146

Origin country :

File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:	xmrig.exe
File size:	8'251'392 bytes
SHA256 hash:	9ef2e8714e85dcd116b709894b43babb4a0872225ae7363152013b7fd1bc95bc
MD5 hash:	4813fa6d610e180b097eae0ce636d2aa
MIME type:	application/x-dosexec
Signature	CoinMiner

File name:	WinRing0x64.sys
File size:	14'544 bytes
SHA256 hash:	11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 hash:	0c0195c48b6b8582fa6f6373032118da
MIME type:	application/x-dosexec
Signature	CoinMiner

File name:	SHA256SUMS
File size:	748 bytes
SHA256 hash:	b4515b917d071091b9c1bf244beb2e5992fc678628dabeed10f86bc0320d999e
MD5 hash:	eea372bde18d98c3245ef91765362c42
MIME type:	text/plain
Signature	CoinMiner

File name:	start.cmd
File size:	159 bytes
SHA256 hash:	d7ee96aa446a5615f0629e0302e98b5c7f6f1e1c50718187a7dabab4a72c9a91
MD5 hash:	0c6540aa7c43d22b2fa061ce5122fea4
MIME type:	text/plain
Signature	CoinMiner

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.HackTool.VulnDriver.x641.D7DBCLASSIC.10119.14589.UNOFFICIAL

Win.Coinminer.Generic-7151250-0

Win.Coinminer.Generic-7151253-0

Win.Coinminer.Generic-7151447-0

Win.Coinminer.Generic-7151972-0

Win.Coinminer.Generic-7155777-0

Win.Coinminer.Generic-7158858-0

Multios.Coinminer.Miner-6781728-2

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug coin coinminer crypto evasive expand greyware lolbin monero xmrig

Link:

https://www.filescan.io/uploads/65758c5fda3178d99cdfd694/reports/7bf08646-c961-46af-bae0-97b03e0a2236/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/366b88c9d03a02d78217b6f707a34f7d8592a60b2d08ef66845698c304837de0

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/366b88c9d03a02d78217b6f707a34f7d8592a60b2d08ef66845698c304837de0

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig miner

Link:

https://tria.ge/reports/231210-l43dpseee9/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/366b88c9d03a02d78217b6f707a34f7d8592a60b2d08ef66845698c304837de0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Linux_Trojan_Pornoasset_927f314f Create hunting rule
Author:	Elastic Security

Rule name:	MacOS_Cryptominer_Generic_333129b7 Create hunting rule
Author:	Elastic Security

Rule name:	MacOS_Cryptominer_Xmrig_241780a1 Create hunting rule
Author:	Elastic Security

Rule name:	MALWARE_Win_CoinMiner02 Create hunting rule
Author:	ditekSHen
Description:	Detects coinmining malware

Rule name:	MAL_XMR_Miner_May19_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Monero Crypto Coin Miner
Reference:	https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

Rule name:	MAL_XMR_Miner_May19_1_RID2E1B Create hunting rule
Author:	Florian Roth
Description:	Detects Monero Crypto Coin Miner
Reference:	https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	rig_win64_xmrig_6_13_1_xmrig Create hunting rule
Author:	yarGen Rule Generator
Description:	rig_win64 - file xmrig.exe
Reference:	https://github.com/Neo23x0/yarGen

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

Rule name:	WHIRLPOOL_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for WhirlPool constants

Rule name:	XMRIG_Monero_Miner Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Monero mining software
Reference:	https://github.com/xmrig/xmrig/releases