MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4de8a124137d5b654de1cdbe4dfdc18102ed436ba703cbd2e44fa3670553c8ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4de8a124137d5b654de1cdbe4dfdc18102ed436ba703cbd2e44fa3670553c8ca
SHA3-384 hash: 87068c94f58c311ec22390a50fea981927b5fc92306587a717af8b7750e269720007bd4c101ae367c8441f24a6f9a9e7
SHA1 hash: f87b98f8f5df9b4505f0da4fbbfea47ef6e2be32
MD5 hash: 391dd1dd7730cad9de95eea8d620c166
humanhash: kentucky-dakota-lion-eight
File name:391dd1dd7730cad9de95eea8d620c166.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:3'738'624 bytes
First seen:2023-02-11 09:08:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c24ea937b2b0d62e829e8a8faeff5a8d (26 x CoinMiner, 1 x CoinMiner.XMRig)
ssdeep 49152:Nme5lkVjplQ1w3gAfo/29XaNraf622vh4JJfsWactKmQXGbtlExqy5jnIAny7dfH:H8VplQ3A82RHp2KjaqOGBle5O7q7uhj
Threatray 48 similar samples on MalwareBazaar
TLSH T1B8062321E5B208F8C61FF979F0B5DD3324D674C274609F998F6CDA6C6A3C592263D08A
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10523/12/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
241
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
391dd1dd7730cad9de95eea8d620c166.exe
Verdict:
Malicious activity
Analysis date:
2023-02-11 09:13:43 UTC
Tags:
miner
Link:
https://app.any.run/tasks/35806b87-86e1-42c1-87ee-52679be52da0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/363874/
Detection(s):
Win.Malware.Trojanx-9977539-0
Create hunting rule

Win.Malware.Miner-9978777-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Using the Windows Management Instrumentation requests
Running batch commands
Creating a file in the Program Files subdirectories
Creating a process from a recently created file
Changing the hosts file
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/68047/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug packed
Link:
https://www.filescan.io/uploads/63e75b33ae0d2eea07d4c795/reports/88633d36-2240-48ae-96df-0fcf784409fb/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/4de8a124137d5b654de1cdbe4dfdc18102ed436ba703cbd2e44fa3670553c8ca
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d27664a7-759d-4eba-97e0-adf4cbb001ea
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
adwa.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1171900
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Creates files in the system32 config directory
DNS related to crypt mining pools
Found hidden mapped module (file has been removed from disk)
Found strings related to Crypto-Mining
Maps a DLL or memory area into another process
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Sample is not signed and drops a device driver
Uses cmd line tools excessively to alter registry or file data
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 804688 Sample: gaBzc029OF.exe Startdate: 11/02/2023 Architecture: WINDOWS Score: 100 61 Antivirus detection for dropped file 2->61 63 Multi AV Scanner detection for dropped file 2->63 65 Multi AV Scanner detection for submitted file 2->65 67 5 other signatures 2->67 7 updater.exe 3 2->7         started        11 gaBzc029OF.exe 1 2->11         started        13 cmd.exe 1 2->13         started        15 8 other processes 2->15 process3 file4 47 C:\Windows\Temp\cqvwhlns.tmp, PE32+ 7->47 dropped 49 C:\Program Filesbehaviorgraphoogle\Libs\WR64.sys, PE32+ 7->49 dropped 69 Protects its processes via BreakOnTermination flag 7->69 71 Writes to foreign memory regions 7->71 73 Modifies the context of a thread in another process (thread injection) 7->73 89 2 other signatures 7->89 17 cmd.exe 7->17         started        20 conhost.exe 7->20         started        23 conhost.exe 7->23         started        51 C:\Program Filesbehaviorgraphoogle\Chrome\updater.exe, PE32+ 11->51 dropped 53 C:\Windows\System32\drivers\etc\hosts, ASCII 11->53 dropped 75 Modifies the hosts file 11->75 77 Adds a directory exclusion to Windows Defender 11->77 25 powershell.exe 36 11->25         started        79 Uses cmd line tools excessively to alter registry or file data 13->79 81 Uses powercfg.exe to modify the power settings 13->81 83 Modifies power options to not sleep / hibernate 13->83 27 reg.exe 1 13->27         started        29 reg.exe 1 13->29         started        31 reg.exe 1 13->31         started        33 8 other processes 13->33 85 Creates files in the system32 config directory 15->85 87 Uses schtasks.exe or at.exe to add and modify task schedules 15->87 35 24 other processes 15->35 signatures5 process6 dnsIp7 59 Modifies power options to not sleep / hibernate 17->59 37 conhost.exe 17->37         started        39 powercfg.exe 17->39         started        41 powercfg.exe 17->41         started        45 2 other processes 17->45 55 135.125.238.108, 14433, 49688 AVAYAUS United States 20->55 57 xmr-eu1.nanopool.org 20->57 43 conhost.exe 25->43         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4de8a124137d5b654de1cdbe4dfdc18102ed436ba703cbd2e44fa3670553c8ca/
Threat name:
Win64.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2023-02-04 01:01:46 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
24 of 39 (61.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jxukcjatpvnwktpbzw7e37obqebo2q3lu4b4xuxej6rwobktzdfa._file
Verdict:
malicious
Similar samples:
1516fd38b103458fca0ab1d8e06f38a0f4eeb9e8b4aa415fe1259d8f131f412a
CoinMiner
4b8e43a1cee980394eb2845ea6657b376746b84b52bbd3d2ea062cbdfb292d5d
CoinMiner
84374cb55c56fb530ef4f83f655ffeb7463e8c0452d7f13d57535d9e032e761f
CoinMiner
94fb7daa65a0b7f111bb4f58a15711aa9b679d2e134041cc4c5b8d147c7cd85e
CoinMiner
cde83c58766ae18bd516cfa78098c411fd1d0ebff083896f35fc33b10afa0e50
CoinMiner
d6516a119c2c08859883d95f97b0bd4b2fb8fbad7d7fae6ed2d79b447177d408
CoinMiner
dcdf6845df1e1aed6f335dd6f2a3ff7351984522235937e5c4a1c746c7fe4371
CoinMiner
eab9a40c5379d460e7d5f3d11c2b766ce8674c2240110e063fecb0c651e0dd67
CoinMiner
fc8104fc4da76a2b556e1bf4e900dc6828fab4cafeaf32b3001e8ba2ff68a200
CoinMiner
+ 38 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig evasion miner upx
Link:
https://tria.ge/reports/230211-k4glkada93/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Executes dropped EXE
Loads dropped DLL
UPX packed file
Drops file in Drivers directory
Stops running service(s)
XMRig Miner payload
Modifies security service
Suspicious use of NtCreateUserProcessOtherParentProcess
xmrig
Unpacked files
SH256 hash:
4de8a124137d5b654de1cdbe4dfdc18102ed436ba703cbd2e44fa3670553c8ca
MD5 hash:
391dd1dd7730cad9de95eea8d620c166
SHA1 hash:
f87b98f8f5df9b4505f0da4fbbfea47ef6e2be32
Link:
https://www.unpac.me/results/61df27b3-01c0-405e-965b-eaa3b12ec7f5/
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4de8a124137d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4de8a124137d5b654de1cdbe4dfdc18102ed436ba703cbd2e44fa3670553c8ca

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 4de8a124137d5b654de1cdbe4dfdc18102ed436ba703cbd2e44fa3670553c8ca

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/363874/
  
URLhaus
https://urlhaus.abuse.ch/url/2536832/
  
Delivery method
Distributed via web download

Comments