MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
CoinMiner
Vendor detections: 14
| SHA256 hash: | 432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67 |
|---|---|
| SHA3-384 hash: | 44e60d1653f0970fd667f4e5b043a3cd797a0c973ea8614a880d4580e05b85f99fce8cb936048c1f38e483f0948b8bf0 |
| SHA1 hash: | 1628635f073c61ad744d406a16d46dfac871c9c2 |
| MD5 hash: | de08b70c1b36bce2c90a34b9e5e61f09 |
| humanhash: | seventeen-magazine-massachusetts-bakerloo |
| File name: | de08b70c1b36bce2c90a34b9e5e61f09 |
| Download: | download sample |
| Signature | CoinMiner |
| File size: | 5'582'848 bytes |
| First seen: | 2024-03-27 17:04:10 UTC |
| Last seen: | 2024-05-01 17:46:24 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 98304:/+p+LLypykV4RJGIfsv7RynHr/x1leOzcv0nbzKIKFStIJ:/+pMLCYJ/svlUr/x1vzcvib+Ir |
| Threatray | 5'117 similar samples on MalwareBazaar |
| TLSH | T1EB46E1337B521966E7C23B32D9AB4012DB3EE1F06B72DBAF298933095907363585570B |
| TrID | 59.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.6% (.SCR) Windows screen saver (13097/50/3) 8.5% (.EXE) Win64 Executable (generic) (10523/12/4) 5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| Reporter |  zbetcheckin |
| Tags: | 32 CoinMiner exe |
Intelligence
File Origin
# of uploads :
6
# of downloads :
507
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67.exe
Verdict:
Malicious activity
Analysis date:
2024-03-27 17:04:53 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
Creating a process from a recently created file
Restart of the analyzed sample
Creating a process with a hidden window
Creating a file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Using the Windows Management Instrumentation requests
Forced system process termination
Deleting a recently created file
Launching a process
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun by creating a file
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
expand lolbin net_reactor packed packed remote
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
PureLog Stealer, zgRAT
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Connects to many ports of the same IP (likely port scanning)
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious Ping/Del Command Combination
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected PersistenceViaHiddenTask
Yara detected PureLog Stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2024-03-27 15:58:34 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
17 of 24 (70.83%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 5'107 additional samples on MalwareBazaar
Result
Malware family:
zgrat
Score:
10/10
Tags:
family:zgrat rat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Detect ZGRat V1
ZGRat
Unpacked files
SH256 hash:
3ac07494c9f66a88f6d67332df784404df49184e1a8368b8703c96b18c21b1cd
MD5 hash:
654302b4b7207ed1cacdd2df635c9ae1
SHA1 hash:
a3cbabc5573b1730c35ed9184ce640b7a31d4300
SH256 hash:
0f3b0fac11d54d42923e2ef103acf1c7b4df9f64d6d406c0fb686b5d53de6d02
MD5 hash:
64670f35037d0168749ae0e605c2faf9
SHA1 hash:
7e2192f0ea4fb36c02cc5a0d66d405ee9a60f436
SH256 hash:
b594af5864bc7a59aeca375e65b55ef79ece941a405c78612e18f6a9e2daa169
MD5 hash:
8e6e3c801825ac5dfced7add749188f8
SHA1 hash:
34834b2ca636cf7c8ae15c87d99ad95ba6bae97c
SH256 hash:
ac148aa09cb74a9676a4bb81ce6de0d21aac9c76b09ebc3d4e99fd74640c0dab
MD5 hash:
f807ef15ea9489b9647e87c65012d0ed
SHA1 hash:
687b91c8586700984bc690e725322be52f10a448
SH256 hash:
bbc7b714d1fef6f51e4d92ab415cd3206736e1ce7737e93a99de161a4aa97ff2
MD5 hash:
58b0b24325810751da19a7a2297a3fbd
SHA1 hash:
6496feff7784abdc8c3024198c81b0ffe2ea21f2
SH256 hash:
36ad4acfe5535d11dfe1e66243c8a891699d5c904c05ff647b1a4efd505e5485
MD5 hash:
e7c24057691cb0098303ead1e06ec862
SHA1 hash:
3294913ef313c4850dec5b6cfd8e0ae72fd3f015
SH256 hash:
a9fd36a8577af86818c4d6428036ca72e45da876b7362574970b37d1d338fc2d
MD5 hash:
9082172e6c73ef206fbf9e68c01551e9
SHA1 hash:
1bebb2171f6c8c5eca4187219410b6dced0644e4
SH256 hash:
d2bd62c508f19aaeda1332ab1cdb547b914dd955b43fce698808ca2ebef36565
MD5 hash:
e5e929d0f96358f04b9d212847330f9d
SHA1 hash:
8bc3945167c780fa735f9b9632fde48281c0dc0b
SH256 hash:
7e0c898d6c36eedc88931390f3ef821d4f53fdc946858db423057701ec5daa6c
MD5 hash:
d9cec5af71482276867ba5a555bbd1b1
SHA1 hash:
82f1f4a04293aa172064a0e28170b2231c014861
SH256 hash:
407e9094206a37707a368f4cd0103269c50b8c0c03edba87b4f20664d259f207
MD5 hash:
e13e6f7986b9d1eff55fe30133592c40
SHA1 hash:
8299d50b76990e9dc7e0a8cc67e2f4d44cb810f5
SH256 hash:
301dd9e149979605013438e865d1cc1755d76c05c306b5f2bb4a8874e8ffcc3d
MD5 hash:
0ae993de6665ae3b54a46c9c1fd9bfc3
SHA1 hash:
393842e2d3a88b8d7b1c2b8579a741361b1248a0
SH256 hash:
75dc0a83d585a9789575a794212888360fbb56229dbf5cdc11d9147eb6a40a19
MD5 hash:
c351c3c95985184040946b33a072b756
SHA1 hash:
36652be706c1ce9f64f7b2a358f06fb3bab8b372
SH256 hash:
432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67
MD5 hash:
de08b70c1b36bce2c90a34b9e5e61f09
SHA1 hash:
1628635f073c61ad744d406a16d46dfac871c9c2
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | PureCrypter |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies PureCrypter, .NET loader and obfuscator. |
| Reference: | https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (GUARD_CF) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://91.215.85.223/ghjk.exe