MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a020d092c12fbf9ed870ae78cc215bf4f8986b8fc89a698d5461a69ade5e05f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a020d092c12fbf9ed870ae78cc215bf4f8986b8fc89a698d5461a69ade5e05f
SHA3-384 hash: 82ea5a9e0c9a287b6937dfd6f29974d14142d8fd7e3c229a721767d16dc2c09f2f78031f98904a97ac1966baa57932c1
SHA1 hash: 33482b69b7dfa3818e6d1a81c1a2cff043f2fa45
MD5 hash: 10ee99d79645e3b527aa4984711e9022
humanhash: ack-india-princess-blossom
File name:3a020d092c12fbf9ed870ae78cc215bf4f8986b8fc89a698d5461a69ade5e05f
Download: download sample
File size:1'839'571 bytes
First seen:2020-11-07 18:31:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4290fa6afc89d56616f34ebbd0b1f2c (50 x CoinMiner)
ssdeep 49152:Lz071uv4B1MkibTIA5lCx7kvRWa4p1HzDgU7yH:NABm
Threatray 111 similar samples on MalwareBazaar
TLSH A38523695E191C7DCAEC213C24BD0F0F81A1DF528148AD78E3E7354F2A6DBAD125F24A
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Coinminer-7331384-0
Create hunting rule

Win.Malware.Eati-7331635-0
Create hunting rule

Win.Trojan.Coinminer-7331970-0
Create hunting rule

Win.Trojan.Coinminer-7331971-0
Create hunting rule

Win.Trojan.Coinminer-7332650-0
Create hunting rule

Win.Trojan.Coinminer-7332688-0
Create hunting rule

Win.Trojan.Coinminer-7332689-0
Create hunting rule

Win.Trojan.Coinminer-7332725-0
Create hunting rule

Win.Trojan.Coinminer-7332745-0
Create hunting rule

Win.Trojan.Coinminer-9670639-0
Create hunting rule

Win.Trojan.Coinminer-9787657-0
Create hunting rule

Win.Trojan.Coinminer-9787666-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the Windows subdirectories
Launching a process
Creating a process from a recently created file
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a020d092c12fbf9ed870ae78cc215bf4f8986b8fc89a698d5461a69ade5e05f/
Gathering data
Verdict:
malicious
Similar samples:
17951136d0013f019008ac6efbef0a7e07191f8b9d1437a8f2288bdabaef12df
59f70c5e1c08e57af20f6362ffa91c675db5bee6614297320383fd9c5f4a60f2
79358bd800eb2a907193bc1f9595b465ab22c1f1d7b562c0ceb6af3ce5e2e144
89d5d36ce9e1a8119729880250f8a3ce47f878c0b1164a62e9ae5751ca0d8b36
99a195a691e9d13e10c9ba4289042e1c224f278d96fffa362181899aa10e83ac
b581539d53ce4764849fe9d166fc268ed760b5652b0f9bb82cc5452629cd213f
c141c25789fb6d9ba283cf8b8657c97894132c998e91e2ff3dc79e9585addafe
c74a0dc8a8bcd0ecab2b7bff864a0e628b60d5269146027fa8f2bd0f2a4d0d3c
c7c51b4c380b59c364a3ec2bad5e69139c662ae2cf8e920954d2cb01b512c8fd
e739b990bade805539447c5145fc87240912b28c73a50858edcc3b4f7c298bc7
+ 101 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201108-8rf6v2xplj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Drops file in Windows directory
Loads dropped DLL
Executes dropped EXE
UPX packed file
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments