MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3
SHA3-384 hash: d97b870e119e99a4ea68f99236ded2afa2284c55f2bc322d81fbc5d459c4b44112693de182917251a72bccfef78f5603
SHA1 hash: 45500603bf8093676b66f056924a71e04793827a
MD5 hash: 2ea6c5e97869622dfe70d2b34daf564e
humanhash: mango-magazine-timing-bluebird
File name:2ea6c5e97869622dfe70d2b34daf564e
Download: download sample
Signature CoinMiner
Create hunting rule
File size:9'728 bytes
First seen:2023-08-17 04:14:10 UTC
Last seen:2024-01-28 19:14:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fda7734b056db13fe95f35927509e47 (3 x Phorpiex, 1 x CoinMiner)
ssdeep 96:zM4LwN8GXhc1I+a8gnYFdj9DSYp+BYA8v7cVO15uJxGE9YUBz2qh3C7tCE4ecp:AwwNfC1TUYv9p+OF8JxTmUBzthcqp
Threatray 111 similar samples on MalwareBazaar
TLSH T150121A0ABDCA40B0E3A08CF057F58B4A8ABE5063179672DFB7B3C5494F5039184677E5
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10523/12/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter zbetcheckin
Tags:32 CoinMiner exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
316
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
phorpiex
Create hunting rule
ID:
1
File name:
2ea6c5e97869622dfe70d2b34daf564e
Verdict:
Malicious activity
Analysis date:
2023-08-17 04:15:07 UTC
Tags:
loader phorpiex trojan miner
Link:
https://app.any.run/tasks/53431f03-40ea-4a7e-8a4e-fa802f803a8c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/443122/
Detection(s):
SecuriteInfo.com.Trojan.Siggen21.19151.26953.8278.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Сreating synchronization primitives
Creating a file in the Windows directory
Enabling the 'hidden' option for recently created files
Sending a custom TCP request
Creating a window
DNS request
Sending a UDP request
Creating a file
Query of malicious DNS domain
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Blocking the Windows Security Center notifications
Creating a file in the mass storage device
Sending an HTTP GET request to an infection source
Enabling threat expansion on mass storage devices
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/103018/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Gathering data
Verdict:
Malicious
Labled as:
Mint.Zard.Generic
Link:
https://www.hybrid-analysis.com/sample/5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d20a4ba0-beee-4c3e-ac0a-c1b33ea24bb4
Result
Threat name:
Phorpiex
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1292566
Signature
Antivirus detection for URL or domain
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to check if Internet connection is working
Contains functionality to detect sleep reduction / modifications
Contains functionality to modify clipboard data
Drops executables to the windows directory (C:\Windows) and starts them
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Phorpiex
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1292566 Sample: mKVBAPvSpM.exe Startdate: 17/08/2023 Architecture: WINDOWS Score: 100 36 Snort IDS alert for network traffic 2->36 38 Multi AV Scanner detection for domain / URL 2->38 40 Found malware configuration 2->40 42 10 other signatures 2->42 7 mKVBAPvSpM.exe 16 2->7         started        12 sysesvcmw.exe 2->12         started        process3 dnsIp4 34 twizt.net 185.215.113.84, 49711, 80 WHOLESALECONNECTIONSNL Portugal 7->34 22 C:\Users\user\AppData\Local\...\135622728.exe, PE32 7->22 dropped 24 C:\Users\user\AppData\Local\...\newtpp[1].exe, PE32 7->24 dropped 48 Hides that the sample has been downloaded from the Internet (zone.identifier) 7->48 14 135622728.exe 1 1 7->14         started        file5 signatures6 process7 file8 26 C:\Windows\ sysesvcmw.exe, PE32 14->26 dropped 50 Multi AV Scanner detection for dropped file 14->50 52 Found evasive API chain (may stop execution after checking mutex) 14->52 54 Contains functionality to check if Internet connection is working 14->54 56 5 other signatures 14->56 18 sysesvcmw.exe 7 13 14->18         started        signatures9 process10 dnsIp11 28 102.130.205.3, 40500 ZAP-AngolaAO Angola 18->28 30 185.245.155.118, 40500 YAHSAT-FRANKFURTLU Germany 18->30 32 52 other IPs or domains 18->32 44 Changes security center settings (notifications, updates, antivirus, firewall) 18->44 46 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->46 signatures12
Detection:
phorpiex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3/
Threat name:
Win32.Worm.Phorpiex
Create hunting rule
Status:
Malicious
First seen:
2023-08-16 18:15:32 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l4ulxkf5epg3lsfd7iayoj546ns6v4y4a233zdj7gcl2qxnqg7zq._file
Verdict:
malicious
Similar samples:
01a3465e5e0f616d60778d071f5c2357ff3064ff6c08086057556e47e6611e82
CoinMiner
09a3a72ed78683c5fbe62e66c33ba7d5dc8b77ca5f52965364e8d41d5622c29d
CoinMiner
48214f32e63f85fe88aff17257a746862d7530bce20b2dfc7a7b942743374a31
CoinMiner
4b56d0b0c8c52803bf7c21587bd98a16f73f0d6ed4e4153eee1964533ac394ee
CoinMiner
68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
CoinMiner
8377023d1c79ff357599359d7d252ec086c53061d6064690791d7ac2679a94dd
CoinMiner
e249064e0227b91181a4cc52d2af88b56d10a01cafea2a4962dca3155f0a37d2
CoinMiner
fc7f4a32ad5d939024f941c04f123edc4e4e51d4974313e001130a2e466119a2
CoinMiner
+ 101 additional samples on MalwareBazaar
Result
Malware family:
phorphiex
Create hunting rule
Score:
  10/10
Tags:
family:phorphiex evasion loader persistence trojan worm
Link:
https://tria.ge/reports/230817-et8peaha5x/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
Windows security modification
Downloads MZ/PE file
Phorphiex
Windows security bypass
Malware Config
C2 Extraction:
http://185.215.113.66/
Unpacked files
SH256 hash:
5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3
MD5 hash:
2ea6c5e97869622dfe70d2b34daf564e
SHA1 hash:
45500603bf8093676b66f056924a71e04793827a
Link:
https://www.unpac.me/results/61f64758-29a2-4b61-92a9-722812809746/
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5f28bba8bd23/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Phorpiex
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/443122/
  
URLhaus
https://urlhaus.abuse.ch/url/2530828/
  
URLhaus
https://urlhaus.abuse.ch/url/2272063/
  
URLhaus
https://urlhaus.abuse.ch/url/2517803/

Comments


Avatar
zbet commented on 2023-08-17 04:14:11 UTC

url : hxxp://185.215.113.66/pei.exe