MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 760ad5c308f4bdc50cc521c93bb3a88c8c25f330234a5086c3b7c82e743f82fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 760ad5c308f4bdc50cc521c93bb3a88c8c25f330234a5086c3b7c82e743f82fe
SHA3-384 hash: 2a661d7746d2e11aa1910fbdd2f9265e1498a9fefaba2f60d63309460221bafce32123c34473ad6215df5b09233e188a
SHA1 hash: c3174c0da347ce4f99a45142d3f7bc4996264d15
MD5 hash: e10a6ece7f3a59d0713386a25f833867
humanhash: video-mississippi-stream-orange
File name:e10a6ece7f3a59d0713386a25f833867
Download: download sample
Signature CoinMiner
Create hunting rule
File size:45'056 bytes
First seen:2021-09-02 01:53:34 UTC
Last seen:2021-09-02 04:39:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 768:snLFwN2WkA9qjJ3hqPlvse+5TfChY0XOvDH6kUeggnvmj1g9unhRF9tbhV:snE2MqvGvu5TKhY0XNklpnvwm9uhRF91
Threatray 192 similar samples on MalwareBazaar
TLSH T17D13F108B3B08A12E8D51BB6116F41950A7FFFE034BAC54FB04D439D5C8C299AEA3B57
Reporter zbetcheckin
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
211
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e10a6ece7f3a59d0713386a25f833867
Verdict:
No threats detected
Analysis date:
2021-09-02 01:56:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d03a5f4a-3d9c-4f3d-a178-825606c56a70

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/184630/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37505163.30183.17360.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Launching a process
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Creating a process with a hidden window
Creating a file
Creating a process from a recently created file
Creating a file in the system32 directory
Sending a UDP request
Creating a file in the system32 subdirectories
DNS request
Connection attempt
Sending a custom TCP request
Creating a service
Launching a service
Loading a system driver
Unauthorized injection to a recently created process
Enabling autorun for a service
Enabling autorun by creating a file
Unauthorized injection to a system process
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e9eca2ae-3db5-44db-8fad-4420cc133860
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/760ad5c308f4bdc50cc521c93bb3a88c8c25f330234a5086c3b7c82e743f82fe/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-29 18:38:37 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oyfnlqyi6s64kdgfehetxm5irsgcl4zqenffbbwdw7ec45b7ql7a._file
Verdict:
malicious
Similar samples:
0633bc4885fc8eb9c2f8bcd8110bff69e47444e68f4beb6757b23b2a2d59d3f7
CoinMiner
0757a3b97f39c1d8a6c3d94770762a3912304cfaffa0330761945acd7f236213
CoinMiner
31f0308a25262c3c2f7e58d60d2c861d73fd4fee2822af6ce393a7676453d3a4
CoinMiner
9dbdfabbc99542e1c94b7a29eaf437b7fa4c898c4add1a677b126257ae54f94e
CoinMiner
bc99b42680a19379e7030dc0871c143afd142ccb9b12efd2942a97e706f7dd59
CoinMiner
df47c9d6c0bcd204919cfd8d495a22ff35f8506cd328410393a724f3548ff828
CoinMiner
ef25bb229ec8ca7d7b2e3d4e23036b74bdc8b9154bb4c5b532e7ea2a0a7c8ee6
CoinMiner
ff1ddb96f4984d4ed65016ca7814432d51a08fe090fae4907e85926469e880da
CoinMiner
+ 182 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig miner
Link:
https://tria.ge/reports/210902-e6zczm43aj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in System32 directory
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Executes dropped EXE
XMRig Miner Payload
xmrig
Unpacked files
SH256 hash:
760ad5c308f4bdc50cc521c93bb3a88c8c25f330234a5086c3b7c82e743f82fe
MD5 hash:
e10a6ece7f3a59d0713386a25f833867
SHA1 hash:
c3174c0da347ce4f99a45142d3f7bc4996264d15
Link:
https://www.unpac.me/results/517560dd-d005-42b9-8384-b8f3e7ab2720/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/760ad5c308f4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/760ad5c308f4bdc50cc521c93bb3a88c8c25f330234a5086c3b7c82e743f82fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_CoinMiner02
Create hunting rule
Author:ditekSHen
Description:Detects coinmining malware
Rule name:MAL_XMR_Miner_May19_1
Create hunting rule
Author:Florian Roth
Description:Detects Monero Crypto Coin Miner
Reference:https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 760ad5c308f4bdc50cc521c93bb3a88c8c25f330234a5086c3b7c82e743f82fe

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1584837/
Cape
Cape
https://www.capesandbox.com/analysis/184630/

Comments


Avatar
zbet commented on 2021-09-02 01:53:35 UTC

url : hxxp://81.163.246.9/xmr.exe