MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 538152a3c9f9473d34289f283d49ddac0a9f350fa5ea5b773bdae67dc2540a95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 9


Intelligence 9 IOCs 2 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 538152a3c9f9473d34289f283d49ddac0a9f350fa5ea5b773bdae67dc2540a95
SHA3-384 hash: 5313004df390a19938ac2451873204d723c031f31143b97d754848beb5320d08b2e309368731fa6a039aa5371334e354
SHA1 hash: 3bc03fd22ea393ab8d3525999a7cbffcd61b1122
MD5 hash: 9393d00d3d52b6c5d669cc103fc95b24
humanhash: jersey-pennsylvania-social-kitten
File name:9393d00d3d52b6c5d669cc103fc95b24.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:184'320 bytes
First seen:2021-09-29 05:36:18 UTC
Last seen:2021-09-29 06:32:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5dbcbed365563713c1a9bb2780528a54 (5 x ArkeiStealer, 3 x RedLineStealer, 2 x RaccoonStealer)
ssdeep 3072:G6KmARLld7aSZ7rGPK5vrcPI1ZeptLbs8EuSzsz:GRTRLfeSNSycPI1EQuSz+
Threatray 8'191 similar samples on MalwareBazaar
TLSH T1A504AE10B590E2F5C742413E6C15DAECE52EB92CEFE05633366426DFAE782A37921313
File icon (PE):PE icon
dhash icon 4839b234e8c38890 (121 x RaccoonStealer, 54 x RedLineStealer, 51 x ArkeiStealer)
Reporter abuse_ch
Tags:CoinMiner exe


Avatar
abuse_ch
CoinMiner C2:
193.56.146.60:18243

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
193.56.146.60:18243 https://threatfox.abuse.ch/ioc/227509/
http://185.215.113.13/g4MbvE/index.php https://threatfox.abuse.ch/ioc/227531/

Intelligence

File Origin
# of uploads :
2
# of downloads :
186
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9393d00d3d52b6c5d669cc103fc95b24.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-29 05:39:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a1dc9d12-82f3-4df1-aba6-8e08b67e6e25

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/192779/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.26425.1520.23521.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6db235ad-6d29-4c5a-954c-3ecbce01e90e
Result
Threat name:
Amadey RedLine SmokeLoader Tofsee
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/860550
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Changes security center settings (notifications, updates, antivirus, firewall)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Contains functionality to register a low level keyboard hook
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Uses known network protocols on non-standard ports
Yara detected Amadey bot
Yara detected AntiVM3
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 492981 Sample: lhpQ30rhq3.exe Startdate: 29/09/2021 Architecture: WINDOWS Score: 100 86 t.me 2->86 88 defeatwax.ru 2->88 90 api.ip.sb 2->90 102 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->102 104 Multi AV Scanner detection for domain / URL 2->104 106 Antivirus detection for URL or domain 2->106 108 18 other signatures 2->108 12 lhpQ30rhq3.exe 2->12         started        15 fuhewws 2->15         started        17 svchost.exe 2->17         started        19 8 other processes 2->19 signatures3 process4 signatures5 140 Detected unpacking (changes PE section rights) 12->140 142 Contains functionality to inject code into remote processes 12->142 144 Injects a PE file into a foreign processes 12->144 21 lhpQ30rhq3.exe 12->21         started        24 fuhewws 15->24         started        146 Changes security center settings (notifications, updates, antivirus, firewall) 17->146 26 MpCmdRun.exe 17->26         started        process6 signatures7 132 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 21->132 134 Maps a DLL or memory area into another process 21->134 136 Checks if the current machine is a virtual machine (disk enumeration) 21->136 28 explorer.exe 14 21->28 injected 138 Creates a thread in another existing process (thread injection) 24->138 33 conhost.exe 26->33         started        process8 dnsIp9 96 193.56.146.41, 49819, 9080 LVLT-10753US unknown 28->96 98 216.128.137.31, 80 AS-CHOOPAUS United States 28->98 100 11 other IPs or domains 28->100 74 C:\Users\user\AppData\Roaming\fuhewws, PE32 28->74 dropped 76 C:\Users\user\AppData\Local\Temp\824.exe, PE32 28->76 dropped 78 C:\Users\user\AppData\Local\Temp\4A00.exe, PE32 28->78 dropped 80 5 other malicious files 28->80 dropped 148 System process connects to network (likely due to code injection or exploit) 28->148 150 Benign windows process drops PE files 28->150 152 Deletes itself after installation 28->152 154 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->154 35 824.exe 28->35         started        39 3E47.exe 2 28->39         started        41 22B3.exe 28->41         started        43 3 other processes 28->43 file10 signatures11 process12 dnsIp13 92 190.2.145.108, 12608, 49917 WORLDSTREAMNL Curacao 35->92 110 Detected unpacking (changes PE section rights) 35->110 112 Query firmware table information (likely to detect VMs) 35->112 114 Tries to detect sandboxes and other dynamic analysis tools (window names) 35->114 116 Tries to detect sandboxes / dynamic malware analysis system (registry check) 35->116 46 conhost.exe 35->46         started        118 Antivirus detection for dropped file 39->118 120 Multi AV Scanner detection for dropped file 39->120 122 Machine Learning detection for dropped file 39->122 48 3E47.exe 14 2 39->48         started        51 conhost.exe 39->51         started        94 cdn.discordapp.com 162.159.135.233, 443, 49828 CLOUDFLARENETUS United States 41->94 124 Hides threads from debuggers 41->124 126 Injects a PE file into a foreign processes 41->126 72 C:\Users\user\AppData\Local\...\oavszyym.exe, PE32 43->72 dropped 128 Detected unpacking (overwrites its own PE header) 43->128 130 Contains functionality to register a low level keyboard hook 43->130 53 4A00.exe 43->53         started        56 3618.exe 43->56         started        file14 signatures15 process16 dnsIp17 82 92.246.89.6, 38437, 49866 LIVECOMM-ASRespublikanskayastr3k6RU Russian Federation 48->82 84 api.ip.sb 48->84 68 C:\Users\user\AppData\Local\Temp\...\7z.exe, PE32+ 53->68 dropped 70 C:\Users\user\AppData\Local\Temp\...\7z.dll, PE32+ 53->70 dropped 58 cmd.exe 53->58         started        file18 process19 process20 60 conhost.exe 58->60         started        62 mode.com 58->62         started        64 7z.exe 58->64         started        66 3 other processes 58->66
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/538152a3c9f9473d34289f283d49ddac0a9f350fa5ea5b773bdae67dc2540a95/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-09-29 05:37:08 UTC
AV detection:
19 of 45 (42.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=koavfi6j7fdt2nbit4ud2so5vqfj6nipuxvfw5z33lth3qsubkkq._file
Verdict:
malicious
Similar samples:
133304b5052863dc2916413ac706f13189ac5a40698bdcbc30f2ed82dd99a1eb
CoinMiner
39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b
CoinMiner
5758800ba2a45f64a6cf7f011159fb521eeacbd18c441adf2748690eee7faa00
CoinMiner
843140b0a3f095d74fe2682d3ae029d4da70a5bae79850cf047a72c9d4a882c0
CoinMiner
897bb67dac34904d72e20fb6b62feb31c86575107563db56535c38d81eec56aa
CoinMiner
b286cfb96b929e11071196a5a8e41b50c8adf29a0e46963e2842f7b19b7f2da5
CoinMiner
e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cfbf9fc9ed24d8dc7d143
CoinMiner
e498ee51d574ae0719fee5da8afb627adc25b946c179815904a65ad4364d0c4a
CoinMiner
f7e22e20cd90f57ce6025dfb5bd05d49963e1915c18abcf16af7503a7215be8b
CoinMiner
f9edbff29a53d95b7eb874b4db8cc83cae6c61f8c7e1d79176d68bf09a842167
CoinMiner
+ 8'181 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:arkei family:raccoon family:redline family:smokeloader family:tofsee family:xmrig botnet:5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 botnet:777777 backdoor discovery evasion infostealer miner persistence spyware stealer themida trojan upx
Link:
https://tria.ge/reports/210929-ga56aadfg2/
Behaviour
Checks SCSI registry key(s)
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Enumerates connected drives
Checks BIOS information in registry
Deletes itself
Drops startup file
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Themida packer
Windows security modification
Blocklisted process makes network request
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
UPX packed file
Arkei Stealer Payload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Nirsoft
XMRig Miner Payload
Arkei
Modifies Windows Defender Real-time Protection settings
Raccoon
RedLine
RedLine Payload
SmokeLoader
Tofsee
Turns off Windows Defender SpyNet reporting
Windows security bypass
xmrig
Malware Config
C2 Extraction:
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
92.246.89.6:38437
193.56.146.60:18243
Unpacked files
SH256 hash:
2fead9437f15e057951fd6a02ab05076e38db13483df0191787c21c79343b9e7
MD5 hash:
1c90f3a3fcd93ee08b2154cbcff49085
SHA1 hash:
73ac881633a13c3c31c1153d8105b8ecbb60961e
Link:
https://www.unpac.me/results/455f7a90-f7af-425b-b28f-b19b5c8f24f3/
SH256 hash:
538152a3c9f9473d34289f283d49ddac0a9f350fa5ea5b773bdae67dc2540a95
MD5 hash:
9393d00d3d52b6c5d669cc103fc95b24
SHA1 hash:
3bc03fd22ea393ab8d3525999a7cbffcd61b1122
Link:
https://www.unpac.me/results/455f7a90-f7af-425b-b28f-b19b5c8f24f3/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/538152a3c9f9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/538152a3c9f9473d34289f283d49ddac0a9f350fa5ea5b773bdae67dc2540a95

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 538152a3c9f9473d34289f283d49ddac0a9f350fa5ea5b773bdae67dc2540a95

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1639930/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/192779/

Comments