MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75e68a5deb7565fc109c7510328ba7a0fae1b9633dfdd97fcd98e3c778f53510. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75e68a5deb7565fc109c7510328ba7a0fae1b9633dfdd97fcd98e3c778f53510
SHA3-384 hash: cc22dc64fa2d3395b32c063668acadfa181a216a4dc15aa8304bd50c4c60a285b4f471a5ef30cd082d28d0c7837f31b0
SHA1 hash: e615dfffb448b0f296e22713e0874e95584d797a
MD5 hash: e43ec0cd56150f4de789c56be14b4d08
humanhash: fifteen-grey-oregon-tango
File name:e43ec0cd56150f4de789c56be14b4d08.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:5'649'856 bytes
First seen:2024-07-23 06:51:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 91ae93ed3ff0d6f8a4f22d2edd30a58e (48 x CoinMiner)
ssdeep 98304:RLbSThOfTCiFBXmfFs+JhEpCVoR8oMEOJ6Ty3RvX+UGD82m:tBfTCiUs0VSLOJgyBGUA8p
Threatray 127 similar samples on MalwareBazaar
TLSH T1E1463311F480A431E03A157615F948B1B07DBCB197314B8FB39E3AB55E31ADC267AA8F
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 7c70747474d67274 (47 x CoinMiner)
Reporter abuse_ch
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
315
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
Win.Malware.F857af-9782719-0
Create hunting rule

Win.Malware.Ymacco-9950875-0
Create hunting rule

Win.Malware.Ymacco-9951150-0
Create hunting rule

SecuriteInfo.com.Python.Stealer.22.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=669f53172f6eaff4b90f4056
Tags:
Encryption
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc microsoft_visual_cc overlay packed packed pyinstaller pyinstaller
Link:
https://www.filescan.io/uploads/669f5318c01cae9c7256bd74/reports/758dbb58-aaaa-4284-9e64-29af3caa6ed6/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/75e68a5deb7565fc109c7510328ba7a0fae1b9633dfdd97fcd98e3c778f53510
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/845bb38c-2cd6-4037-a509-17ad4196c7ee
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1479141
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/75e68a5deb7565fc109c7510328ba7a0fae1b9633dfdd97fcd98e3c778f53510
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/75e68a5deb7565fc109c7510328ba7a0fae1b9633dfdd97fcd98e3c778f53510/
Threat name:
Win32.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2024-07-23 06:52:09 UTC
File Type:
PE (Exe)
Extracted files:
13
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oxtiuxplovs7yee4ouidfc5hud5odoldhx65s76ntdr4o6hvguia._file
Verdict:
malicious
Similar samples:
35118d4ed995388333e3bcd09e9981f1006bf81ab54ab54b4f6be028fde948b2
CoinMiner
3fde84a46aea58ba4ddb5fb0473fc756ff209ba96b1a63a2759d13b8adc01a69
CoinMiner
415e9cf5345f01f0dd41e964c8f8bd8aa4e8dac56f3275cafc8e67925403c5b7
CoinMiner
47268ec33e1cc7a2fdcb9d872554f9a110e1bc00fa21819ee8235983eb32d80c
CoinMiner
5ea9a5f6e8dfdebb2c87e7801439a512abc2d03e52af091f5d373cff1d1a55e5
CoinMiner
75e68a5deb7565fc109c7510328ba7a0fae1b9633dfdd97fcd98e3c778f53510
CoinMiner
d20a311d17a5e9bc3f6843314321fcdd961cc117c79e5445235775adbbeff2ed
CoinMiner
+ 117 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
pyinstaller
Link:
https://tria.ge/reports/240723-hm3flatdmp/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8d6f8f5e-9840-4963-a3f0-54cc088e631c
Unpacked files
SH256 hash:
75e68a5deb7565fc109c7510328ba7a0fae1b9633dfdd97fcd98e3c778f53510
MD5 hash:
e43ec0cd56150f4de789c56be14b4d08
SHA1 hash:
e615dfffb448b0f296e22713e0874e95584d797a
Detections:
PyInstaller
Create hunting rule
Link:
https://www.unpac.me/results/4f3e3123-5a8c-46fc-b119-41baa9b3a7a6/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 75e68a5deb7565fc109c7510328ba7a0fae1b9633dfdd97fcd98e3c778f53510

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2905202/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineW
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::RemoveDirectoryW
KERNEL32.dll::SetDllDirectoryW

Comments