MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68984f5ac7696cc5398c6b9912770041953b3d7bb1f92cd16854b5a0db1955bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 11

Intelligence 11 IOCs YARA 8 File information Comments

SHA256 hash:	68984f5ac7696cc5398c6b9912770041953b3d7bb1f92cd16854b5a0db1955bc
SHA3-384 hash:	36a0252a2f7761372d2b5775f387a738e0216b65eab7458cd47a67e635a69025241102fab9ef9592b8550d84f1340b8f
SHA1 hash:	5b68e0d3e170207b04b96eb23a4f67620cba0170
MD5 hash:	10bb8c29f65868b36a454c722ae01969
humanhash:	twelve-india-high-alanine
File name:	10bb8c29f65868b36a454c722ae01969.exe
Download:	download sample
Signature	Mirai Create hunting rule
File size:	4'303'360 bytes
First seen:	2022-09-17 07:37:40 UTC
Last seen:	2022-09-17 09:25:31 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	98304:N4OyiLwkUPYwyuZXPklUrQj3AZBKMisGmiNX1bsUtS1r4xM0/o:NbNLw1PrZ/bsbUmCQX3tSqA
Threatray	297 similar samples on MalwareBazaar
TLSH	T1FE16338E7FE21249C3BC3BB16436B61A8026FE191D57CE1E39817694C761357BC0BAE1
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):
dhash icon	71d8b4a4a0cac871 (1 x Mirai, 1 x PripyatMiner)
Reporter	abuse_ch
Tags:	exe mirai PripyatMiner

Intelligence

File Origin

# of uploads :

# of downloads :

326

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

10bb8c29f65868b36a454c722ae01969.exe

Verdict:

No threats detected

Analysis date:

2022-09-17 07:45:39 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/7f912e54-56fd-410c-8726-3f6cfeb40e05

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/310873/

Detection(s):

SecuriteInfo.com.Win64.CoinminerX-gen.25141.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %AppData% subdirectories

Using the Windows Management Instrumentation requests

Launching a process

Creating a file

DNS request

Connecting to a cryptocurrency mining pool

Sending a custom TCP request

Creating a service

Launching a service

Loading a system driver

Creating a file in the Windows subdirectories

Enabling autorun for a service

Query of malicious DNS domain

Unauthorized injection to a system process

Sending an HTTP POST request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

coinminer packed

Link:

https://www.filescan.io/uploads/632579d6258cf225c27766af/reports/011b0c1d-98bb-4800-b455-0c1f9931b7d6/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/db9420e8-16b1-470d-a3d9-c73c6f5e4363

Result

Threat name:

Crypto Miner, Xmrig

Detection:

malicious

Classification:

evad.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1072190

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Found strings related to Crypto-Mining

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

System process connects to network (likely due to code injection or exploit)

Writes to foreign memory regions

Yara detected Crypto Miner

Yara detected RUNPE

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Detection:

mirai

Link:

https://mwdb.cert.pl/sample/68984f5ac7696cc5398c6b9912770041953b3d7bb1f92cd16854b5a0db1955bc/

Threat name:

ByteCode-MSIL.Trojan.CoinminerX

Status:

Malicious

First seen:

2022-09-16 17:58:31 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

17 of 26 (65.38%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ncme6wwhnfwmkommnomre5yaigktwpl3wh4szuliks22bwyzkw6a._file

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig miner

Link:

https://tria.ge/reports/220917-jgd2gsdcep/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

XMRig Miner payload

xmrig

Gathering data

Unpacked files

SH256 hash:

68984f5ac7696cc5398c6b9912770041953b3d7bb1f92cd16854b5a0db1955bc

MD5 hash:

10bb8c29f65868b36a454c722ae01969

SHA1 hash:

5b68e0d3e170207b04b96eb23a4f67620cba0170

Link:

https://www.unpac.me/results/d8e97be8-7f9e-4099-97ab-2c7980b7cd91/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/68984f5ac7696cc5398c6b9912770041953b3d7bb1f92cd16854b5a0db1955bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_CoinMiner02 Create hunting rule
Author:	ditekSHen
Description:	Detects coinmining malware

Rule name:	MAL_XMR_Miner_May19_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Monero Crypto Coin Miner
Reference:	https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

Rule name:	MAL_XMR_Miner_May19_1_RID2E1B Create hunting rule
Author:	Florian Roth
Description:	Detects Monero Crypto Coin Miner
Reference:	https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

Rule name:	RansomwareTest3 Create hunting rule
Author:	Daoyuan Wu
Description:	Test Ransomware YARA rules

Rule name:	RansomwareTest4 Create hunting rule
Author:	Daoyuan Wu
Description:	Test Ransomware YARA rules

Rule name:	RansomwareTest6 Create hunting rule
Author:	Daoyuan Wu
Description:	Test Ransomware YARA rules

Rule name:	Record_Breaker_Similarities Create hunting rule
Author:	DigitalPanda

Rule name:	rig_win64_xmrig_6_13_1_xmrig Create hunting rule
Author:	yarGen Rule Generator
Description:	rig_win64 - file xmrig.exe
Reference:	https://github.com/Neo23x0/yarGen