MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 435ecb52f149f02217a2b205a39e68776923f4c16a9ca4b8f2db0b3a9f297670. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 435ecb52f149f02217a2b205a39e68776923f4c16a9ca4b8f2db0b3a9f297670
SHA3-384 hash: 42613264cef364ee7073b151227e8bf87a17f3e8af0eae76b24ebb350d71e99b40622b36dfb507e637fd14a5a7f407cf
SHA1 hash: 6c7fdde057c09a1694012ce68339978a4bc5d190
MD5 hash: e0ae7add4a87b6a9e5161006e4e4e40f
humanhash: video-cardinal-muppet-oscar
File name:E0AE7ADD4A87B6A9E5161006E4E4E40F.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:1'636'352 bytes
First seen:2021-09-11 18:15:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 94a38222f822f877e3097bc3f229e72a (1 x RaccoonStealer, 1 x CoinMiner)
ssdeep 24576:vUtTGJUVtqb7xAkmijauMug/iyFzb2DfsPV8A4C2vNI1cPdf8xZLGNfav9f:8NG+HuxWiOuRg/iyFzb2QN83XfeYaF
TLSH T1A1753A31E200C239E8E725F556BD3A79356CAA71470439C72BC81EF99B222D97E3416F
dhash icon e8d959ccc866e6c3 (3 x RaccoonStealer, 2 x CoinMiner, 1 x Tofsee)
Reporter abuse_ch
Tags:CoinMiner exe


Avatar
abuse_ch
CoinMiner C2:
http://92.63.102.119/anti/messagelimitscriptsearcher/htop/limitmessage/Cam/MathprodlogMath/ruleDjangorecordCam/screen/eternalimagedefaultGenerator.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://92.63.102.119/anti/messagelimitscriptsearcher/htop/limitmessage/Cam/MathprodlogMath/ruleDjangorecordCam/screen/eternalimagedefaultGenerator.php https://threatfox.abuse.ch/ioc/220382/

Intelligence

File Origin
# of uploads :
1
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://ninite.com/avg/
Verdict:
Malicious activity
Analysis date:
2021-09-07 03:05:59 UTC
Tags:
evasion trojan rat azorult stealer raccoon loader fareit pony redline
Link:
https://app.any.run/tasks/2ac3cdb8-c309-4368-948d-0c05fa225c3b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/187084/
Detection(s):
Win.Malware.Zusy-9891357-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Malware family:
Glupteba
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5442af8d-ff56-4716-be98-137b08729c1c
Result
Threat name:
DCRat Glupteba Metasploit Raccoon RedLin
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/849239
Signature
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Creates processes via WMI
Detected unpacking (changes PE section rights)
Disable Windows Defender real time protection (registry)
Drops PE files to the document folder of the user
Drops PE files with benign system names
Found many strings related to Crypto-Wallets (likely being stolen)
Found Tor onion address
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
May modify the system service descriptor table (often done to hook functions)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected DCRat
Yara detected Glupteba
Yara detected Metasploit Payload
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 481668 Sample: zfl3hUTQWN.exe Startdate: 11/09/2021 Architecture: WINDOWS Score: 100 56 95.181.163.181 RACKTECHRU Russian Federation 2->56 58 74.114.154.22 AUTOMATTICUS Canada 2->58 60 3 other IPs or domains 2->60 104 Multi AV Scanner detection for domain / URL 2->104 106 Antivirus detection for URL or domain 2->106 108 Multi AV Scanner detection for dropped file 2->108 110 17 other signatures 2->110 8 zfl3hUTQWN.exe 4 73 2->8         started        13 svchost.exe 1 2->13         started        signatures3 process4 dnsIp5 72 37.0.10.214 WKD-ASIE Netherlands 8->72 74 31.192.214.222 NETINTERNETNetinternetBilisimTeknolojileriASTR Turkey 8->74 76 8 other IPs or domains 8->76 30 C:\Users\...\mrFVTIjK6GH4PwwTPgdeCjz_.exe, PE32 8->30 dropped 32 C:\Users\...\lnmOGz4W0whxrBFoIbPMm6XQ.exe, PE32 8->32 dropped 34 C:\Users\...\kBHvVVjiI6uE_MwA2nDH6fXv.exe, PE32 8->34 dropped 36 53 other files (26 malicious) 8->36 dropped 112 Drops PE files to the document folder of the user 8->112 114 Disable Windows Defender real time protection (registry) 8->114 15 lnmOGz4W0whxrBFoIbPMm6XQ.exe 6 15 8->15         started        19 5_bmO2Lv5C1RfMDWX6nzsd5A.exe 8->19         started        22 mrFVTIjK6GH4PwwTPgdeCjz_.exe 8->22         started        24 9 other processes 8->24 file6 signatures7 process8 dnsIp9 38 C:\Users\...\OlCeyrspZr445VAmpVpxr0RM.exe, PE32 15->38 dropped 40 C:\...\bzFkAyPfYA5xcceZWcfVjpiW.exe, PE32 15->40 dropped 42 C:\Program Files (x86)\...\csrss.exe, PE32 15->42 dropped 50 3 other files (1 malicious) 15->50 dropped 78 Drops PE files to the document folder of the user 15->78 80 Creates multiple autostart registry keys 15->80 82 Creates an autostart registry key pointing to binary in C:\Windows 15->82 98 2 other signatures 15->98 62 5.181.156.77 MIVOCLOUDMD Moldova Republic of 19->62 64 95.216.186.40 HETZNER-ASDE Germany 19->64 52 59 other files (none is malicious) 19->52 dropped 84 Tries to steal Mail credentials (via file access) 19->84 86 Tries to harvest and steal browser information (history, passwords, etc) 19->86 88 Tries to detect virtualization through RDTSC time measurements 19->88 90 Query firmware table information (likely to detect VMs) 22->90 92 Tries to detect sandboxes and other dynamic analysis tools (window names) 22->92 100 2 other signatures 22->100 66 208.95.112.1 TUT-ASUS United States 24->66 68 149.154.167.99 TELEGRAMRU United Kingdom 24->68 70 2 other IPs or domains 24->70 44 C:\...\PowerControl_Svc.exe, PE32 24->44 dropped 46 C:\Program Files (x86)\...\md8_8eus.exe, PE32 24->46 dropped 48 C:\Program Files (x86)\...\inst001.exe, PE32 24->48 dropped 54 2 other files (1 malicious) 24->54 dropped 94 Detected unpacking (changes PE section rights) 24->94 96 Contains functionality to inject code into remote processes 24->96 102 2 other signatures 24->102 26 conhost.exe 24->26         started        28 conhost.exe 24->28         started        file10 signatures11 process12
Detection:
glupteba
Create hunting rule
Link:
https://mwdb.cert.pl/sample/435ecb52f149f02217a2b205a39e68776923f4c16a9ca4b8f2db0b3a9f297670/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-09-06 14:47:39 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=inpmwuxrjhycef5cwic2hhtio5ush5gbnkokjohs3mftvhzjozya._file
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:dcrat family:glupteba family:metasploit family:redline family:smokeloader family:vidar botnet:1k_slow botnet:937 agilenet backdoor discovery dropper evasion infostealer loader persistence rat stealer suricata themida trojan
Link:
https://tria.ge/reports/210911-wwfvvaefem/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Checks computer location settings
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Themida packer
Downloads MZ/PE file
Executes dropped EXE
DCRat Payload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar Stealer
DcRat
Glupteba
Glupteba Payload
MetaSploit
Modifies Windows Defender Real-time Protection settings
Process spawned unexpected child process
RedLine
RedLine Payload
SmokeLoader
Vidar
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
Malware Config
C2 Extraction:
ieleishark.xyz:80
https://gheorghip.tumblr.com/
http://fazanaharahe1.xyz/
http://xandelissane2.xyz/
http://ustiassosale3.xyz/
http://cytheriata4.xyz/
http://ggiergionard5.xyz/
http://rrelleynaniy6.store/
http://danniemusoa7.store/
http://nastanizab8.store/
http://onyokandis9.store/
http://dmunaavank10.store/
http://gilmandros11.site/
http://cusanthana12.site/
http://willietjeana13.site/
http://ximusokall14.site/
http://blodinetisha15.site/
http://urydiahadyss16.club/
http://glasamaddama17.club/
http://marlingarly18.club/
http://alluvianna19.club/
http://xandirkaniel20.club/
Unpacked files
SH256 hash:
435ecb52f149f02217a2b205a39e68776923f4c16a9ca4b8f2db0b3a9f297670
MD5 hash:
e0ae7add4a87b6a9e5161006e4e4e40f
SHA1 hash:
6c7fdde057c09a1694012ce68339978a4bc5d190
Link:
https://www.unpac.me/results/ab1b0dd7-5a58-4617-929f-4c68602b8a45/
Malware family:
Raccoon v1.7.2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/435ecb52f149/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/435ecb52f149f02217a2b205a39e68776923f4c16a9ca4b8f2db0b3a9f297670

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation
Create hunting rule
Author:ditekSHen
Description:Detects executables containing potential Windows Defender anti-emulation checks
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:MALWARE_Win_Vidar
Create hunting rule
Author:ditekSHen
Description:Detects Vidar / ArkeiStealer
Rule name:pe_imphash
Create hunting rule
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Vidar
Create hunting rule
Author:kevoreilly
Description:Vidar Payload
Rule name:win_smominru_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.smominru.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/187084/

Comments