MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 407146c61a75f7671060b112142faf417a40b5b8be35ac0cb2fb931219ccb073. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 407146c61a75f7671060b112142faf417a40b5b8be35ac0cb2fb931219ccb073
SHA3-384 hash: b66d7251e514e3d11cce54cf7f9a41637e52974ace705069a4d4be824270fb9508cb7dae5543789b8c7e07a7ee3deba3
SHA1 hash: 2ec093b0b856c8a974f6a465a660e4b285499bcf
MD5 hash: cc652b2de964189d5af7416982fbf90d
humanhash: foxtrot-apart-burger-thirteen
File name:407146c61a75f7671060b112142faf417a40b5b8be35ac0cb2fb931219ccb073
Download: download sample
File size:2'412'869 bytes
First seen:2020-11-07 19:01:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4290fa6afc89d56616f34ebbd0b1f2c (50 x CoinMiner)
ssdeep 49152:Lz071uv4BUMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDiiQc:NABB
Threatray 106 similar samples on MalwareBazaar
TLSH BEB533168F1D5C3FDBE8567C283D0F5F0790CA024001AAB196C626DA1F9CF6E1A5F97A
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Coinminer-7331384-0
Create hunting rule

Win.Trojan.Coinminer-7331970-0
Create hunting rule

Win.Trojan.Coinminer-7331971-0
Create hunting rule

Win.Trojan.Coinminer-7332650-0
Create hunting rule

Win.Trojan.Coinminer-9670639-0
Create hunting rule

Win.Trojan.Coinminer-9787657-0
Create hunting rule

Win.Trojan.Coinminer-9787666-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the Windows subdirectories
Launching a process
Creating a process from a recently created file
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/407146c61a75f7671060b112142faf417a40b5b8be35ac0cb2fb931219ccb073/
Gathering data
Verdict:
malicious
Similar samples:
11574d2f1b8924807b8ce193ee0b8e868845066d965f471ecf6a00606c240966
17951136d0013f019008ac6efbef0a7e07191f8b9d1437a8f2288bdabaef12df
418cc6f42a9c585548d8f02ca7c605723b657172483b904c35ccd69a8bf62c6c
5ec2a270a9b0e335fb6ecf9d313e02771acad023d7a1a6168a15297d1f80312d
68dc7c7dfdac09078ca6c904bedaa8975a5c1f06390dfdffffed453d75474014
6ca54d07235739dc0ff481344f7d87c465fc223b2197d68c69a98806153e6aa9
a25294daa6e96a4c39c666fe14355a0c98dc5c68fb8b6834583e598581d94c98
aed1ec82acd83e514cab79421231da4075fa9a31efe802436814dda0903590e5
beeef3cfbb7ab4c32e924c51fb53782fa6b1994c0456e22d3216318791006398
c141c25789fb6d9ba283cf8b8657c97894132c998e91e2ff3dc79e9585addafe
+ 96 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201108-rjykxtepka/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Drops file in Windows directory
Loads dropped DLL
Blacklisted process makes network request
Executes dropped EXE
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments