MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4109d37d472fafa83b2c8303afd3fe9c25d58e763d706ae8f660a9f150971665. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4109d37d472fafa83b2c8303afd3fe9c25d58e763d706ae8f660a9f150971665
SHA3-384 hash: 81753bd8e6a8e962ea27a73af65d15aadd3607ebe2214ad97efe44dc0591b4c502c68c24a5b086f838a498ed31ff63b4
SHA1 hash: 65bab83487798744fa75b2a144c39e70faccfcef
MD5 hash: 5e2d3eddb851b087f7e0b26775923c21
humanhash: michigan-michigan-sink-lion
File name:7027_1648133534_4507.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:3'294'152 bytes
First seen:2022-03-24 17:57:51 UTC
Last seen:2022-03-25 06:58:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4e4095a0d90406c8428c5d9a9c6b05b7 (26 x CoinMiner, 4 x CoinMiner.XMRig)
ssdeep 98304:7p2Q5yj1t2dPdUVopD37BjAI/QhN/oM6WB:7UU4CdUCRBLQhNQMp
Threatray 309 similar samples on MalwareBazaar
TLSH T1FAE502792248335CC01EC4745033BD84E2F6565E1FF9D56AB2EBFAC07BB7851A906B0A
Reporter pr0xylife
Tags:CoinMiner exe XMRIG

Intelligence

File Origin
# of uploads :
3
# of downloads :
328
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
arkei
Create hunting rule
ID:
1
File name:
i864x__setup__623cbc48290a9.exe
Verdict:
Malicious activity
Analysis date:
2022-03-25 01:57:19 UTC
Tags:
loader evasion trojan opendir stealer arkei vidar rat redline socelars ransomware stop
Link:
https://app.any.run/tasks/a7a02096-c603-4d55-a046-9f31bd7cba63

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/257268/
Detection(s):
SecuriteInfo.com.Win32.Packed.VMProtect.ACR.28981.10196.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% subdirectories
Launching a process
Creating a process with a hidden window
Searching for synchronization primitives
DNS request
Connecting to a cryptocurrency mining pool
Sending a custom TCP request
Creating a service
Launching a service
Loading a system driver
Sending an HTTP GET request
Forced system process termination
Blocking the Windows Defender launch
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Sending an HTTP GET request to an infection source
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  0/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/11182/overview
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/623cb12e0cd58dbd92e8c9a1/reports/aab195a3-1aa3-40e4-886d-34766e4a8242/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/35d74e3b-3b18-4218-942a-ccbba9176c57
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/963937
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Blacklisted process start detected (Windows program)
Detected Stratum mining protocol
DNS related to crypt mining pools
Found strings related to Crypto-Mining
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Sigma detected: Notepad Making Network Connection
Sigma detected: Suspicious Process Parents
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 596418 Sample: 7027_1648133534_4507.exe Startdate: 24/03/2022 Architecture: WINDOWS Score: 100 66 xmr-eu1.nanopool.org 2->66 68 easyproducts.org 2->68 78 Antivirus detection for URL or domain 2->78 80 Antivirus detection for dropped file 2->80 82 Multi AV Scanner detection for dropped file 2->82 84 8 other signatures 2->84 9 7027_1648133534_4507.exe 1 5 2->9         started        14 RegHost.exe 1 2->14         started        signatures3 process4 dnsIp5 70 185.137.234.33, 49759, 49761, 8080 SELECTELRU Russian Federation 9->70 54 C:\Users\user\AppData\...\RegModule.exe, PE32+ 9->54 dropped 56 C:\Users\user\AppData\Roaming\...\RegHost.exe, PE32+ 9->56 dropped 58 C:\Users\user\AppData\Roaming\...\RegData.exe, PE32+ 9->58 dropped 60 C:\Users\user\AppData\...\OneDrive.exe, PE32+ 9->60 dropped 86 Hijacks the control flow in another process 9->86 88 Injects code into the Windows Explorer (explorer.exe) 9->88 90 Writes to foreign memory regions 9->90 92 Injects a PE file into a foreign processes 9->92 16 notepad.exe 1 9->16         started        20 explorer.exe 1 9->20         started        22 bfsvc.exe 1 9->22         started        24 conhost.exe 9->24         started        94 Multi AV Scanner detection for dropped file 14->94 96 Allocates memory in foreign processes 14->96 98 Modifies the context of a thread in another process (thread injection) 14->98 26 notepad.exe 1 14->26         started        28 explorer.exe 1 14->28         started        30 bfsvc.exe 1 14->30         started        32 conhost.exe 14->32         started        file6 signatures7 process8 dnsIp9 62 51.255.34.118 OVHFR France 16->62 64 xmr-eu1.nanopool.org 16->64 72 System process connects to network (likely due to code injection or exploit) 16->72 74 Query firmware table information (likely to detect VMs) 16->74 76 Blacklisted process start detected (Windows program) 16->76 34 conhost.exe 16->34         started        36 curl.exe 1 20->36         started        38 conhost.exe 20->38         started        50 2 other processes 20->50 40 conhost.exe 22->40         started        42 conhost.exe 26->42         started        44 conhost.exe 28->44         started        46 curl.exe 28->46         started        48 conhost.exe 30->48         started        signatures10 process11 process12 52 conhost.exe 36->52         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4109d37d472fafa83b2c8303afd3fe9c25d58e763d706ae8f660a9f150971665/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-03-24 17:02:07 UTC
File Type:
PE+ (Exe)
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iee5g7khf6x2qozmqmb27u76tqs5ldtwhvygv2hwmcu7cuexczsq._file
Verdict:
malicious
Similar samples:
1fca453f1f9a6acf20ba5a9828178d70426e7f8e58ec6116f2aacf96053e0037
CoinMiner
24cf5566094b9c99b75303995b503b3285531d1313658f318a931424c9ef46d3
CoinMiner
69a7e42a1c0b9413c66f96880ba467ebe5b103740224f0d90dd5ad0862e37a5d
CoinMiner
c47c10545767892ba8fdaa1ba682295251016938318d807fe40736e5ae832322
CoinMiner
cf9d82a4d67beb905befac24665ccb76ac0bc9de390e335ab393072c5c37d281
CoinMiner
d2e800b01162a5151738eb524ef4bd36faeba8dd33b8c3d68edb635c29d38d9b
CoinMiner
f563d62dbc6bcf5f8c0f977bcd3bc66d39ee43cc5abdd63d3de105755dab3f91
CoinMiner
fc739b3b8bd5157690d248132ee974ad3d62292959d99cc68c44b2d61cb3907d
CoinMiner
fe7e378c72ec43fca46360a46a8fc8c0d5ec0f4739ce3286610774fdec47edda
CoinMiner
+ 299 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan upx
Link:
https://tria.ge/reports/220324-wj6whaccg3/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Downloads MZ/PE file
UPX packed file
Modifies Windows Defender Real-time Protection settings
Unpacked files
SH256 hash:
4109d37d472fafa83b2c8303afd3fe9c25d58e763d706ae8f660a9f150971665
MD5 hash:
5e2d3eddb851b087f7e0b26775923c21
SHA1 hash:
65bab83487798744fa75b2a144c39e70faccfcef
Link:
https://www.unpac.me/results/628ed815-f874-4303-be3b-6c7af1748e7b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/4109d37d472fafa83b2c8303afd3fe9c25d58e763d706ae8f660a9f150971665

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/257268/

Comments