MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53379b36716f384e530dae9ec883c459d0c12f0260116614a0482ded7d9b5ba9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 9

Intelligence 9 IOCs 3 YARA 17 File information Comments

SHA256 hash:	53379b36716f384e530dae9ec883c459d0c12f0260116614a0482ded7d9b5ba9
SHA3-384 hash:	70336a19881f39435b27a0c42115e937f96f2aa35406e252ec20e1978eb4ebdd120a98e324932600bdf7a0b74396076a
SHA1 hash:	63c94ed4abc8aff9001293045bc4d8ce549a47b8
MD5 hash:	ec149486075982428b9d394c1a5375fd
humanhash:	october-red-enemy-eighteen
File name:	sahiba_6.txt
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	860'160 bytes
First seen:	2021-07-14 14:13:42 UTC
Last seen:	2021-07-14 15:07:53 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	82622a0f8bdba4396a94457d8c2772ea (1 x CoinMiner)
ssdeep	24576:AkRkLis0EC5vKcYEfD14BjI9KzTm6Br8:470nFJ4hzTZBr8
Threatray	40 similar samples on MalwareBazaar
TLSH	T1C9057C12B782F4B1DCB101B0577AA7D6922CBC240379DADBA3C42F5D99790C27932BD6
Reporter	CholeVallabh
Tags:	CoinMiner exe

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
185.244.182.34:56068	https://threatfox.abuse.ch/ioc/160383/
80.92.206.25:4311	https://threatfox.abuse.ch/ioc/160432/
109.248.11.240:18612	https://threatfox.abuse.ch/ioc/160525/

Intelligence

File Origin

# of uploads :

# of downloads :

177

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/171683/

Detection(s):

SecuriteInfo.com.Variant.Zusy.393000.25362.18461.UNOFFICIAL

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Chapak

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9d179cd8-8222-4419-9c9a-b8285ca6d8ba

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/816278

Signature

Disable Windows Defender real time protection (registry)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/53379b36716f384e530dae9ec883c459d0c12f0260116614a0482ded7d9b5ba9/

Threat name:

Win32.Trojan.Phonzy

Status:

Malicious

First seen:

2021-07-13 18:52:24 UTC

AV detection:

18 of 29 (62.07%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=km3zwntrn44e4uynv2pmra6elhimclycmaiwmffajaw627m3louq._file

Verdict:

malicious

CoinMiner

0a765858b1eef141ad5fff4a66cafe5ecba3d4e4e0f6547a705d3813b6f25ae0

CoinMiner

6c8131fc986f9477582f43530e0bdc660887285c83360c52e6b68876a57dc9b0

CoinMiner

923fdc536587c13f249d07089d331efbe489f34f8ca7d3986909909b4f468f46

CoinMiner

b08e7b20a96d4bf0d2795d783b2b066abff7c0d82ccb15e616df533835193f5d

CoinMiner

bf86597d2d10ad8d82f0af8b53cf72757094322e79e92180092aa60341b90034

CoinMiner

c21002370700932f744db40abd356df44e0a665459f20fa62b7703b865c48318

CoinMiner

eddbfe52ba633950c388e0303d5a04453f9ba9e3a3cdc60f9a1355707cd209e6

CoinMiner

+ 30 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:fickerstealer family:glupteba family:metasploit family:raccoon family:redline family:smokeloader family:tofsee family:vidar botnet:13_7_r botnet:865 botnet:903 botnet:mixryzki2k botnet:new_crypt_1_20k botnet:sel12 agilenet backdoor discovery dropper evasion infostealer loader persistence spyware stealer themida trojan upx vmprotect

Link:

https://tria.ge/reports/210714-nxtv9v9g3j/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Creates scheduled task(s)

Delays execution with timeout.exe

Kills process with taskkill

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Modifies registry class

Modifies system certificate store

Runs .reg file with regedit

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in Program Files directory

Drops file in Windows directory

Launches sc.exe

Drops file in System32 directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Checks BIOS information in registry

Checks computer location settings

Loads dropped DLL

Modifies file permissions

Obfuscated with Agile.Net obfuscator

Reads local data of messenger clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Themida packer

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

UPX packed file

VMProtect packed file

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Vidar Stealer

Fickerstealer

Glupteba

Glupteba Payload

MetaSploit

Modifies Windows Defender Real-time Protection settings

Process spawned unexpected child process

Raccoon

RedLine

RedLine Payload

SmokeLoader

Suspicious use of NtCreateProcessExOtherParentProcess

Suspicious use of NtCreateUserProcessOtherParentProcess

Tofsee

Vidar

Malware Config

C2 Extraction:

woltelorda.xyz:80
185.215.113.62:51929
https://olegf9844.tumblr.com/
kathonaror.xyz:80
45.140.147.128:4311
xtarweanda.xyz:80
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
195.133.40.204:80

Unpacked files

SH256 hash:

53379b36716f384e530dae9ec883c459d0c12f0260116614a0482ded7d9b5ba9

MD5 hash:

ec149486075982428b9d394c1a5375fd

SHA1 hash:

63c94ed4abc8aff9001293045bc4d8ce549a47b8

Link:

https://www.unpac.me/results/059a90f8-8ac0-463d-b472-f9e5e8354559/

Parent samples :

e3135f01a3b76a91bb1082fd5b53259fe2d59eb6ab550fcc6fa6c866412920f8
e52e6bbf7705f9b90e4a20f2935cb86ee6078035f14d873d1c126c6ba9ccc551
27425ab21814acdc92665957ce92f326a46ea99131ef32df83ccaeaaa5228c20
55f22aa33b837e543e8a58408ed843e41515292dead43b57b2ae42b735c34f11

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/53379b36716f384e530dae9ec883c459d0c12f0260116614a0482ded7d9b5ba9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	INDICATOR_EXE_Packed_VMProtect Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with VMProtect.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	INDICATOR_SUSPICOIUS_EXE_WindDefender_AntiEmaulation Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing potential Windows Defender anti-emulation checks

Rule name:	MALWARE_Win_HyperBro03 Create hunting rule
Author:	ditekSHen
Description:	Hunt HyperBro IronTiger / LuckyMouse / APT27 malware

Rule name:	MALWARE_Win_RedLine Create hunting rule
Author:	ditekSHen
Description:	Detects RedLine infostealer

Rule name:	MALWARE_Win_Vidar Create hunting rule
Author:	ditekSHen
Description:	Detects Vidar / ArkeiStealer

Rule name:	pe_imphash Create hunting rule

Rule name:	RedLine Create hunting rule
Author:	@bartblaze
Description:	Identifies RedLine stealer.

Rule name:	redline_new_bin Create hunting rule
Author:	James_inthe_box
Description:	Redline stealer
Reference:	https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8

Rule name:	redline_new_mem Create hunting rule
Author:	James_inthe_box
Description:	Redline stealer
Reference:	https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8/

Rule name:	redline_stealer Create hunting rule
Author:	jeFF0Falltrades
Description:	This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)

Rule name:	RedOctoberPluginCollectInfo Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_XORed_MSDOS_Stub_Message Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed MSDOS stub message
Reference:	https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings

Rule name:	Vidar Create hunting rule
Author:	kevoreilly
Description:	Vidar Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/171683/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample