MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f42cb8b36103e8140f03dce854015c32cb5f20635361838a82581d9796cfa2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f42cb8b36103e8140f03dce854015c32cb5f20635361838a82581d9796cfa2d
SHA3-384 hash: 93837034ff228f70d54162a8e1d33d9d888b6adf8d7c5b2364e9df81b0967100eb3f7e8c4cab51fff31e4afc197e34f3
SHA1 hash: 8802cdc849316529f42b82a9abd09100399d1c95
MD5 hash: 39a01f14391add3df50581518a969f3c
humanhash: two-friend-foxtrot-blossom
File name:7f42cb8b36103e8140f03dce854015c32cb5f20635361838a82581d9796cfa2d
Download: download sample
File size:11'278'606 bytes
First seen:2020-11-10 06:53:28 UTC
Last seen:2024-07-24 16:48:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f06dc709a5b17f58964c6e5478a768b5 (4 x CobaltStrike, 4 x Riskware.Generic, 1 x CoinMiner)
ssdeep 196608:w7rXHA1idw9/I6uDMIuMmsVTEu1xtT/c/i7gCsLFa:wf3A1juDR71T/3gCl
Threatray 169 similar samples on MalwareBazaar
TLSH 82B67D27F4E204F9CA7FD07086979772BA31746A43307BA71F90EA751E12F906A2E714
Reporter seifreed

Intelligence

File Origin
# of uploads :
2
# of downloads :
45
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Pseudosigner-36
Create hunting rule

SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Win.Trojan.CobaltStrike-8091534-0
Create hunting rule

Win.Tool.CobaltStrike-6336852-0
Create hunting rule

Win.Malware.Tofsee-6896728-0
Create hunting rule

Win.Malware.Tofsee-7057860-0
Create hunting rule

Win.Coinminer.Generic-7158858-0
Create hunting rule

Multios.Coinminer.Miner-6781728-2
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending a UDP request
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7f42cb8b36103e8140f03dce854015c32cb5f20635361838a82581d9796cfa2d/
Threat name:
Win64.Trojan.CoinMiner
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 06:56:04 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0997dd01a7962e8949d6865d70d7fe6c9771055276123ef2615c721dbc804347
122ec58305457383ce015846fe9598d3ff42c7eae8de6d936d5751b31e75b18f
207baef67d279f7a610295723d1f619d1696feead9b9bc7991ac7798cd4db685
2450692674a0f223fdbfd29c6f6f2990858026815e34d88f7ef3584bdd731f2d
28077a71b3aff9c96a58949ab21b2c9494ff76bbe29ea5df497fa9e2fc26b5a0
40060eb0d5e769d9a65987c9c1bace3525e0fe6b6ca0f1b5693b2ba4871d032b
474186239b198102d48b399c5f9336a63672c52af39ac35443e7c42078cbf778
59a183ac03488ada3515b20bbf3cc3f018a84e77837ace9c3588903a785e0353
98479114ba34e54a2677c023118977d7f3e432bd4f587f4e4043eac0d4302d72
9c1c3f79f2695b16bead4cd1a59ab513e01afa4e85ce69401698192f50caffeb
+ 159 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/201110-1c4em37zdn/
Behaviour
Modifies system certificate store
Malware Config
C2 Extraction:
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments