MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fa24025283e6b745f20c81e15a8cdb866905fb079579b71efd9e659398cb574. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 13


Intelligence 13 IOCs 2 YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fa24025283e6b745f20c81e15a8cdb866905fb079579b71efd9e659398cb574
SHA3-384 hash: ec909c8bc3d9b2e2e855be3b95ac0af2217073f3c745df2d4130b3fc67a50167ef27d19dbcf3d836f53ffc1a6913f100
SHA1 hash: e5c8063186673888b173ff6bc4466dcd6e122e0d
MD5 hash: 3a7c2b0eb8ad94e61ea3c1ac3d6590e9
humanhash: pluto-idaho-texas-yellow
File name:7FA24025283E6B745F20C81E15A8CDB866905FB079579.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:3'472'682 bytes
First seen:2022-02-05 11:25:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c05041e01f84e1ccca9c4451f3b6a383 (141 x RedLineStealer, 101 x GuLoader, 64 x DiamondFox)
ssdeep 98304:Jroztd1Po4w0x3aYy0X6aKLjSQpZ3rWD1:J8R3aUZ6L1frWD1
Threatray 2'363 similar samples on MalwareBazaar
TLSH T1A0F53350BA86A043C5A3C9F1AD2F2A170677EB5F15EE200B8B207FCE7E843858DD6755
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:CoinMiner exe


Avatar
abuse_ch
CoinMiner C2:
5.188.168.132:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
104.168.44.52:80 https://threatfox.abuse.ch/ioc/290710/
5.188.168.132:80 https://threatfox.abuse.ch/ioc/379316/

Intelligence

File Origin
# of uploads :
1
# of downloads :
271
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7FA24025283E6B745F20C81E15A8CDB866905FB079579.exe
Verdict:
No threats detected
Analysis date:
2022-02-05 12:38:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f683199d-348b-4f10-be4e-39bc5314cd5a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Create hunting rule
Link:
https://www.capesandbox.com/analysis/233511/
Detection(s):
Win.Malware.Generic-9852703-0
Create hunting rule

Win.Packed.Barys-9859531-0
Create hunting rule

Win.Malware.Barys-9859550-0
Create hunting rule

Win.Trojan.Jaik-9862229-0
Create hunting rule

Win.Malware.Generic-9863888-0
Create hunting rule

Win.Packed.Jaik-9863991-0
Create hunting rule

Win.Packed.Trojanx-9873669-0
Create hunting rule

Win.Packed.SmokeLoader-9873637-1
Create hunting rule

Win.Malware.Malwarex-9882661-0
Create hunting rule

Win.Dropper.Malwarex-9882944-0
Create hunting rule

Win.Malware.Generickdz-9883917-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
Searching for the window
Moving a recently created file
Running batch commands
Sending a custom TCP request
DNS request
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Creating a process with a hidden window
Creating a window
Unauthorized injection to a recently created process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/6040/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/61fe8f659046890c53adadb8/reports/ca94196a-37d9-4eb6-9d6a-641ef06704ca/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/979515ce-6924-4ebb-b77a-6b355f834812
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/934485
Signature
.NET source code contains very large strings
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Detected unpacking (changes PE section rights)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has a writeable .text section
PE file has nameless sections
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 566960 Sample: 7FA24025283E6B745F20C81E15A... Startdate: 05/02/2022 Architecture: WINDOWS Score: 100 68 live.goatgame.live 2->68 88 Multi AV Scanner detection for domain / URL 2->88 90 Found malware configuration 2->90 92 Malicious sample detected (through community Yara rule) 2->92 94 13 other signatures 2->94 12 7FA24025283E6B745F20C81E15A8CDB866905FB079579.exe 10 2->12         started        15 fafifjd 2->15         started        signatures3 process4 file5 66 C:\Users\user\AppData\...\setup_installer.exe, PE32 12->66 dropped 18 setup_installer.exe 18 12->18         started        110 Antivirus detection for dropped file 15->110 112 Detected unpacking (changes PE section rights) 15->112 114 Machine Learning detection for dropped file 15->114 116 4 other signatures 15->116 signatures6 process7 file8 48 C:\Users\user\AppData\...\setup_install.exe, PE32 18->48 dropped 50 C:\Users\user\AppData\Local\...\sahiba_9.txt, PE32 18->50 dropped 52 C:\Users\user\AppData\Local\...\sahiba_8.txt, PE32 18->52 dropped 54 13 other files (10 malicious) 18->54 dropped 96 Antivirus detection for dropped file 18->96 22 setup_install.exe 1 18->22         started        signatures9 process10 file11 56 C:\Users\user\AppData\...\sahiba_2.exe (copy), PE32 22->56 dropped 58 C:\Users\user\...\sahiba_10.exe (copy), PE32 22->58 dropped 60 C:\Users\user\AppData\...\sahiba_1.exe (copy), PE32 22->60 dropped 62 7 other files (none is malicious) 22->62 dropped 98 Antivirus detection for dropped file 22->98 100 Detected unpacking (changes PE section rights) 22->100 102 Machine Learning detection for dropped file 22->102 26 cmd.exe 1 22->26         started        28 cmd.exe 1 22->28         started        30 conhost.exe 22->30         started        32 cmd.exe 22->32         started        signatures12 process13 process14 34 sahiba_2.exe 26->34         started        37 sahiba_1.exe 2 28->37         started        signatures15 80 Detected unpacking (changes PE section rights) 34->80 82 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 34->82 84 Maps a DLL or memory area into another process 34->84 86 2 other signatures 34->86 39 explorer.exe 1 34->39 injected 44 sahiba_1.exe 1 37->44         started        process16 dnsIp17 70 nasufmutlu.com 39->70 72 thegymmum.com 39->72 78 4 other IPs or domains 39->78 64 C:\Users\user\AppData\Roaming\fafifjd, PE32 39->64 dropped 104 System process connects to network (likely due to code injection or exploit) 39->104 106 Benign windows process drops PE files 39->106 108 Hides that the sample has been downloaded from the Internet (zone.identifier) 39->108 74 live.goatgame.live 44->74 76 192.168.2.1 unknown unknown 44->76 46 conhost.exe 44->46         started        file18 signatures19 process20
Gathering data
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-31 09:06:44 UTC
File Type:
PE (Exe)
Extracted files:
185
AV detection:
34 of 43 (79.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p6reajjihzvxixzazapblkgnxbtjax5qpflzw4pp3htfsommwv2a._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
ryuk
Create hunting rule
Similar samples:
10c760b38e37d7df4fdb3caa56328e51943ac422018b1261fbd4820cdaa046d3
CoinMiner
549953d5db2a4646740e721e24ec1b7fa57ef6c4d72ffa32752b17d4a65c36e4
CoinMiner
67e030c1c7dd08138eb1d6a12a4d652c4a304f22db556afce411c32a23bddf23
CoinMiner
7fa24025283e6b745f20c81e15a8cdb866905fb079579b71efd9e659398cb574
CoinMiner
9e719c4dd5e1086d5197fded7b8cdb0d3d592c0636b0d469fcda22c9723e8e7c
CoinMiner
b2e7eea64a4e8e56b43cf70b5b383ce06b0d43757d143a95b31ea9c8db6ac5a2
CoinMiner
e00ddba4fd34c7b0f0f2e547ee9e3ff4c0cb4d906f1ca26b17ba2e3f459c59bd
CoinMiner
eeb0c6a760a7c9d17c02dbacf4f4715917caf3d111209ce29b67b366dc8b9dd9
CoinMiner
+ 2'353 additional samples on MalwareBazaar
Result
Malware family:
tofsee
Create hunting rule
Score:
  10/10
Tags:
family:onlylogger family:redline family:tofsee botnet:aniold botnet:new aspackv2 evasion infostealer loader persistence spyware stealer trojan
Link:
https://tria.ge/reports/220205-njvt8sahc2/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Launches sc.exe
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Looks up geolocation information via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
ASPack v2.12-2.42
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
OnlyLogger Payload
Modifies Windows Defender Real-time Protection settings
OnlyLogger
RedLine
RedLine Payload
Tofsee
Malware Config
C2 Extraction:
liezaphare.xyz:80
jainestaynor.xyz:80
patmushta.info
ovicrush.cn
Unpacked files
SH256 hash:
0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498
MD5 hash:
cc0d6b6813f92dbf5be3ecacf44d662a
SHA1 hash:
b968c57a14ddada4128356f6e39fb66c6d864d3f
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
55361941ab12c7edd987c706d25423d868f756fab1028d99eeffacdabf3da4ca
MD5 hash:
4de4b7bc0a92902422c4204fcfa58150
SHA1 hash:
587e0299ea32cc836281998941daa60f471e3480
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
40ca14be87ccee1c66cce8ce07d7ed9b94a0f7b46d84f9147c4bbf6ddab75a67
MD5 hash:
7165e9d7456520d1f1644aa26da7c423
SHA1 hash:
177f9116229a021e24f80c4059999c4c52f9e830
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
ff5b7e9a2d5af436c13951d0746015237e3b12f4d4dc845a92b4e430c098e224
MD5 hash:
8ecc287212bb08f80f80c4ec1a7c6c4c
SHA1 hash:
59d08bda2e494600ed25fd608582b25261ec13b0
Detections:
win_vidar_auto
Create hunting rule
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
Parent samples :
7fa24025283e6b745f20c81e15a8cdb866905fb079579b71efd9e659398cb574
65341b1f7f4018e163e564b546012d5bfa41a70c9b9926a0b48781ae4e3f9ec3
d3de52ec5e00eff831e15a2719c702f98fbcf95183849dea98d1483c6f171446
7140765cd0d5f61bb453f0511e24786e21d950c2cb3b30aa2945ba1846a4e0a5
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a
dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
SH256 hash:
207056003b4b6e55dfe2557a2d1ca119c7785cfe626328a4a8c74323238933e9
MD5 hash:
4955a27a03f35933fdbd801f425b6c58
SHA1 hash:
97f3b8f33fd1a49cf9db5a246d996047beef3c12
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
Parent samples :
db50d646494970b78887d4d84f52147c4cdbaa0b23cb4eb330ffa2403735937c
f1e1b516a83f303659e53d513c9c3da9dfd466f40b96f8de86ca37ce9544d234
d3de52ec5e00eff831e15a2719c702f98fbcf95183849dea98d1483c6f171446
7140765cd0d5f61bb453f0511e24786e21d950c2cb3b30aa2945ba1846a4e0a5
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
93ac84d519edb6350cf53736449330985fe1cb52eff043857daf6cca916d6fa3
dad9e695e9f592e48326dd349556f81987c115ad152bf3433f12d969135d943a
dc812fa1ae68dfa017cfde268e2ae523019308b102bce0acb1656c08b34dc818
269d2ae2661789f8929d934a7f7e44b6d6fa2e2fc3799fd53b44988aed906b1f
SH256 hash:
4c04bbd20bf11d1d66df52d9beb4404ed202416992f000295ce8bcd47b5d773b
MD5 hash:
8cbbd53180a0206362445336996f43f0
SHA1 hash:
b41ed3234317ff1cac47d684af8639ec2a211152
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
7d7d5ae0fa9286fea65a6f94240389998ff0d08340a2aedc67ef3547e84d64c6
MD5 hash:
270dd1da0ab7f38cdff6fab84562ec7a
SHA1 hash:
cf7be169ee4415085baeb4aeaa60932ac5abf4ac
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
08ff3e3f7c7148ed5d559de3c2a5fc6c3668f88e54c5472f68529f2983411856
MD5 hash:
81f26d1ce16c7ea00bc62e341e64625c
SHA1 hash:
b666e80f667fc80ecd4fa077e37d4baeec1a17a8
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
b221b54f968aa70f8014e794a91f139c7c2a18ddd813b04efcd796dc1c257a50
MD5 hash:
0cd858d2c522795127f853c5e886477a
SHA1 hash:
a2062ba2bd9e521a2076b4f1053b534d2c907ddb
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
71f5bb7d9ace05cfb89e95843499c1c19ca1d6c8b1cd66561d24ceb9ffa94862
MD5 hash:
7a99d0912a3371081b8a866c6ff48351
SHA1 hash:
6b1d33d1afec238f49a23be639790145ee0b3dfd
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
Parent samples :
7140765cd0d5f61bb453f0511e24786e21d950c2cb3b30aa2945ba1846a4e0a5
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
SH256 hash:
392b00fc8b5a49b2ba3545eb490fc0c5040fb18a6f330d102ca06d8390183bb9
MD5 hash:
5a81c749a3f9285f10899f0969519475
SHA1 hash:
2d960778cba6667f630d5bbca8a4482885b0941a
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
da72fa2ad767e22db3d55506846b5d4db7932cd7287391c483faa80c5e86bcce
MD5 hash:
eb73f48eaf544bf7e035a58f95f73394
SHA1 hash:
251f0d09f14452538ecfa0924a4618c3c16887e3
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
MD5 hash:
c0d18a829910babf695b4fdaea21a047
SHA1 hash:
236a19746fe1a1063ebe077c8a0553566f92ef0f
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
e1cc6a9d780602fe6e789bf5c3a27e87e197a4e3bf7c8138ea2f9dfec70fb963
MD5 hash:
f707252b9c9579677fffb013e0cfc646
SHA1 hash:
8ab483023fa8773afb8c13464c39c5b8e687f126
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
edd2a0334bfcf63a8c9b9d3a148fd6ad7f76a757ea56589b0670cb72d7dce6ff
MD5 hash:
ad6992e6f028f1f9cd8714ad4cf5313e
SHA1 hash:
f837082d106727a30ff849ed3838da6cfdd4b29c
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
4a013358eb6de187261c006032f6d518539b6ecc63962bdb8b141de9cbfd5df7
MD5 hash:
d10576b82d2714ac45e0fc89ed6938dc
SHA1 hash:
75d55f17835bd3a454115c8db10a80a515cb0cea
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
3e3a5961f6d5ca586d7f2ef0830eea16f168ab0e8b63d281ffc12a27dcbfde9b
MD5 hash:
126799c774eaab2387fe39eb5d4fcef0
SHA1 hash:
1eb68d48d8ae2829d2bb498e3ec1274ddc91e11c
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
a44daa993632ffb1fb4a1faf7b290318d07bb242a081230578e67fcba57615ba
MD5 hash:
668960d5d4afb0024cb967cf6b495673
SHA1 hash:
14ca4cdbd4a07d0fac894c0f3f01c9ab5d2d50d0
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
e427f8ef21691e3d8c2313d11129ad08ddef69a158eca2f77c170603478ff0c4
MD5 hash:
0dedd909aae9aa0a89b4422106310e9e
SHA1 hash:
271d36afa5b729ee590cf8066166ca5e9c9d0340
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
b62319b3f9e30e77b69174a94515037579780cb1f61de6144a44c654879eb98a
MD5 hash:
0ff2be1ebebbc04479dc25ef6fbebda4
SHA1 hash:
65fe6dd0d87b8a3db21fbfa8e2396d098a3d923a
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
SH256 hash:
7fa24025283e6b745f20c81e15a8cdb866905fb079579b71efd9e659398cb574
MD5 hash:
3a7c2b0eb8ad94e61ea3c1ac3d6590e9
SHA1 hash:
e5c8063186673888b173ff6bc4466dcd6e122e0d
Link:
https://www.unpac.me/results/fde65493-4c38-4fa9-a7de-f6ac5f011d5c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7fa24025283e6b745f20c81e15a8cdb866905fb079579b71efd9e659398cb574

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ASPack
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ASPack
Rule name:MALWARE_Win_DLInjector03
Create hunting rule
Author:ditekSHen
Description:Detects unknown loader / injector
Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:RedLine_a
Create hunting rule
Author:@bartblaze
Description:Identifies RedLine stealer.
Rule name:redline_new_bin
Create hunting rule
Author:James_inthe_box
Description:Redline stealer
Reference:https://app.any.run/tasks/4921d1fe-1a14-4bf2-9d27-c443353362a8
Rule name:redline_stealer
Create hunting rule
Author:jeFF0Falltrades
Description:This rule matches unpacked RedLine Stealer samples and derivatives (as of APR2021)
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/233511/

Comments