MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ca54d07235739dc0ff481344f7d87c465fc223b2197d68c69a98806153e6aa9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ca54d07235739dc0ff481344f7d87c465fc223b2197d68c69a98806153e6aa9
SHA3-384 hash: a037ce78143087e472d0131c39b19143a57b1c8c99d0311fb5ac7dc04037ccd02b8440d8fe2ce61b33cc2bd463f72924
SHA1 hash: ef74279dac759f712ebb896b0aef8b463fe5b217
MD5 hash: d2e70d8466de2501d727d8080efd1fbe
humanhash: batman-enemy-juliet-oranges
File name:6ca54d07235739dc0ff481344f7d87c465fc223b2197d68c69a98806153e6aa9
Download: download sample
File size:810'793 bytes
First seen:2020-11-07 20:17:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4290fa6afc89d56616f34ebbd0b1f2c (50 x CoinMiner)
ssdeep 12288:J5LnfEnwhTb2GlaekkIWQm/w2ONMXpGXXUAjeX/95ETPl3WXDwXMDYMYpzJbiWNB:JanwhSe11QSONCpGJCjETPlGqzJO0RR
Threatray 107 similar samples on MalwareBazaar
TLSH 410523850A2A79E6C275193D24C50D04862B26F5E95C3A24E7B753D36FBCBF93C7A00E
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Eati-7331431-0
Create hunting rule

Win.Malware.Eati-7331499-0
Create hunting rule

Win.Trojan.Mansabo-9670631-0
Create hunting rule

Win.Trojan.Mansabo-9787656-0
Create hunting rule

Win.Trojan.Mansabo-9787658-0
Create hunting rule

Win.Trojan.Mansabo-9787665-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the system32 directory
Creating a process from a recently created file
Creating a window
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ca54d07235739dc0ff481344f7d87c465fc223b2197d68c69a98806153e6aa9/
Threat name:
Win64.Trojan.CoinMiner
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 20:38:49 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
13667895d952d43a44d7b2bb57abdd637668c236c39a96d73db6abac2f7ae56d
174f9c83762b54312988e24bf9292dfd0fd44b62ce8b86463af269059379e746
1f39a2d168cf2fe25fddc7ff3026e356f1f81cc8bdf11d57051b991fe8985b2c
1fea4184fd49bc45c6f69a0dcf92439214b19ecf9f7c4ccfdf6b250f923989b3
2c3976f92e475e102d50542d4b72b4954522f2ca454fe8f23911000ea6ecc1b4
54a7d9ced364000bd8d7bd0e8d25959428caf0f16c867e0a6c0e78174f22d22f
6ced2a55d8fb09e055d45be4d63c4afdb5827d681daad738e7da7d23f2bbaafe
8b2ad76fd9b5620ef5b6f3b6141060469adb113ef7f57a4b43991dc379224fa6
9504b3b1cf0c21196ec76fc281c2fbc82a183fedfa49c203fa9f2b5d4477a255
db326ccd883340391506f7f5c260460dbd757bf6541d8429dd2178e0a89d3d3f
+ 97 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201108-4fa8g5g26s/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments