MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55f429935a1ccd1ded86968c7ee688a3169031789ce4b1c23ad2375daef8d911. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner.XMRig

Vendor detections: 13

Intelligence 13 IOCs 1 YARA File information Comments

SHA256 hash:	55f429935a1ccd1ded86968c7ee688a3169031789ce4b1c23ad2375daef8d911
SHA3-384 hash:	daef8708fcd99baa944efcc93c39aba80489e7ceb014777c7d517556b75a8ae4bd94c0863995ad1ddc387315f2d97f80
SHA1 hash:	94f64bc505c3036a4ef0a275e70be8d38f6c0710
MD5 hash:	5393e992690ce0c4e2e51695dd572968
humanhash:	mississippi-seven-shade-burger
File name:	5393e992690ce0c4e2e51695dd572968.exe
Download:	download sample
Signature	CoinMiner.XMRig Create hunting rule
File size:	301'568 bytes
First seen:	2022-01-09 15:06:04 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	494d9e5cf9082316783ab2dc17a63b60 (1 x CoinMiner.XMRig, 1 x RaccoonStealer)
ssdeep	3072:WMsLsJFfpZVVPtFFgjXRFLp0xrfTBcl8WrxpzbgqruJ3fedz:WMsLyFjr3FsoTBDuzbgwuJ2
Threatray	6'215 similar samples on MalwareBazaar
TLSH	T14C54BF3DBAECC832C4D306B49864DBD15A3EBC315965814B36241B6E5E33ECC4AE631E
File icon (PE):
dhash icon	fcfcf4d4d4d4d8c0 (41 x RedLineStealer, 30 x RaccoonStealer, 9 x Smoke Loader)
Reporter	abuse_ch
Tags:	CoinMiner.XMRig exe

abuse_ch

CoinMiner.XMRig C2:
45.9.20.101:23970

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
45.9.20.101:23970	https://threatfox.abuse.ch/ioc/292069/

Intelligence

File Origin

# of uploads :

# of downloads :

391

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

5393e992690ce0c4e2e51695dd572968.exe

Verdict:

Suspicious activity

Analysis date:

2022-01-09 15:08:51 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/060a91cc-6f3f-44b2-ba2e-8f5805c2d0a1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/217915/

Detection(s):

Win.Malware.Mikey-9917879-0

Win.Packed.Lockbit-9919158-0

Win.Dropper.Tofsee-9919472-0

Win.Dropper.Lockbit-9919572-0

Win.Malware.Stopcrypt-9933337-0

Win.Dropper.Tofsee-9934046-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

DNS request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Sending a custom TCP request

Sending an HTTP GET request

Creating a file in the %temp% directory

Creating a process from a recently created file

Using the Windows Management Instrumentation requests

Query of malicious DNS domain

Sending a TCP request to an infection source

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/3926/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

CPUID_Instruction

CheckCmdLine

EvasionGetTickCount

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/61daf9de1c0d769df9dbebb1/reports/ce9c7227-549c-41b6-9c2e-bdaba5204679/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9b7d2691-b19b-422d-811d-8eec841032aa

Result

Threat name:

RedLine SmokeLoader Tofsee Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/917316

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Drops executables to the windows directory (C:\Windows) and starts them

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Modifies the windows firewall

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

PE file has a writeable .text section

Query firmware table information (likely to detect VMs)

Sigma detected: Copying Sensitive Files with Credential Data

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious Svchost Process

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade analysis by execution special instruction which cause usermode exception

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected Tofsee

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/55f429935a1ccd1ded86968c7ee688a3169031789ce4b1c23ad2375daef8d911/

Threat name:

Win32.Trojan.Raccoon

Status:

Malicious

First seen:

2022-01-09 15:07:10 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kx2cte22dtgr33mgs2gh5zuiumljamlyttsldqr22i3v3lxy3eiq._file

Verdict:

malicious

CoinMiner.XMRig

13b783d0b5826a825f6c402d295622d1913510155bdccbaad15b4bc633108523

CoinMiner.XMRig

3acc2e00534ea6d6347c0c73761d787305a62b829872ea02febe8984c3d3ae7c

CoinMiner.XMRig

4883c8f935d8c8397ffb003f72e4e515501820ebd37ca079c478ba5b7ed7b3d4

CoinMiner.XMRig

aea2cbc32b7925ab28e619b8deb5c540ea8e61ad631b02e348be04b87f44627a

CoinMiner.XMRig

b996410101b932721193c3cbe614edfe760875dab9d0067e16220fcec55d32fb

CoinMiner.XMRig

d6b47354dff2693d279b357d0901496908922679207ebef447e78160cd45bdf3

CoinMiner.XMRig

eb24b3b9375f0b3272fac6eecc9329f79eab274d802b2ad37037cc83a46fa3f1

CoinMiner.XMRig

+ 6'205 additional samples on MalwareBazaar

Result

Malware family:

tofsee

Score:

10/10

Tags:

family:arkei family:loaderbot family:raccoon family:smokeloader family:tofsee backdoor collection discovery evasion loader miner persistence spyware stealer suricata trojan upx

Link:

https://tria.ge/reports/220109-sgspbadhep/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Delays execution with timeout.exe

Modifies registry class

Script User-Agent

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: LoadsDriver

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Program crash

Launches sc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Checks BIOS information in registry

Deletes itself

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

UPX packed file

Arkei Stealer Payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

LoaderBot executable

Arkei

LoaderBot

Raccoon

SmokeLoader

Suspicious use of NtCreateProcessExOtherParentProcess

Tofsee

Windows security bypass

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Malware Config

C2 Extraction:

http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
patmushta.info
parubey.info