🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fefb4ac689e7334f5d66e01673dda50a293bbd7bca0bf3da972f01d32f54587. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 10


Intelligence 10 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fefb4ac689e7334f5d66e01673dda50a293bbd7bca0bf3da972f01d32f54587
SHA3-384 hash: fcb8c732711c105c8ca9c78dc9e63a1d95e583b248d77d76b36522cf691cd6211d144fef5fee4e40dc13568a807e2263
SHA1 hash: 20a13c242d7454d8ea845734cf74f8d902bf7e80
MD5 hash: 651bb4e90bb174d1feabad9d8013ee36
humanhash: echo-nineteen-seventeen-diet
File name:651bb4e90bb174d1feabad9d8013ee36.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:146'432 bytes
First seen:2021-08-24 11:37:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 162ff6c25457b1f40ac1c6c4d1ab5060 (7 x RaccoonStealer, 4 x CoinMiner, 1 x RedLineStealer)
ssdeep 1536:6ahUuMEhnNikDBLCRw3yqMamflDITD685dKdYOnMBriobhO2Yp2:KINJBLB3ykmVIC85dDOegM
Threatray 5'807 similar samples on MalwareBazaar
TLSH T142E3BE1138F8C437D456497148E2CAA0F63BB8A26BB5550733E84F5F9E213E0B72939E
dhash icon 4839b2b4e8c38890 (137 x RaccoonStealer, 37 x Smoke Loader, 30 x RedLineStealer)
Reporter abuse_ch
Tags:CoinMiner exe


Avatar
abuse_ch
CoinMiner C2:
http://185.234.247.35/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.234.247.35/ https://threatfox.abuse.ch/ioc/193640/

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
651bb4e90bb174d1feabad9d8013ee36.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-24 12:35:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4dee4f28-3c08-4153-a1e4-211716d8c2b0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/181852/
Detection(s):
Win.Packed.Fragtor-9888193-0
Create hunting rule

Win.Packed.Generic-9888253-0
Create hunting rule

Win.Packed.Generic-9888255-0
Create hunting rule

Win.Packed.Generic-9888260-0
Create hunting rule

Win.Packed.Filerepmalware-9888319-0
Create hunting rule

Win.Packed.Generic-9888330-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt
Sending an HTTP POST request
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Connection attempt to an infection source
Launching a process
Query of malicious DNS domain
Sending a TCP request to an infection source
Deleting of the original file
Enabling autorun by creating a file
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/981e4f11-b1d8-4d2f-a20e-d3de02f27fc3
Result
Threat name:
Ades Stealer Raccoon RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/838186
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
Binary or sample is protected by dotNetProtector
Changes security center settings (notifications, updates, antivirus, firewall)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the windows firewall
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sigma detected: Copying Sensitive Files with Credential Data
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Uses netsh to modify the Windows network and firewall settings
Yara detected Ades Stealer
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Telegram RAT
Yara detected Tofsee
Yara detected Vidar
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 470616 Sample: FhKq0cr6Av.exe Startdate: 24/08/2021 Architecture: WINDOWS Score: 100 88 www.google.com 2->88 90 verizon.net 2->90 92 38 other IPs or domains 2->92 122 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->122 124 Antivirus detection for URL or domain 2->124 126 Yara detected Vidar 2->126 128 16 other signatures 2->128 10 FhKq0cr6Av.exe 2->10         started        13 uuuarht 2->13         started        15 svchost.exe 2->15         started        17 10 other processes 2->17 signatures3 process4 dnsIp5 138 Detected unpacking (changes PE section rights) 10->138 140 Contains functionality to inject code into remote processes 10->140 142 Injects a PE file into a foreign processes 10->142 20 FhKq0cr6Av.exe 10->20         started        23 uuuarht 13->23         started        144 Changes security center settings (notifications, updates, antivirus, firewall) 15->144 86 127.0.0.1 unknown unknown 17->86 25 WerFault.exe 17->25         started        signatures6 process7 signatures8 130 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 20->130 132 Maps a DLL or memory area into another process 20->132 134 Checks if the current machine is a virtual machine (disk enumeration) 20->134 27 explorer.exe 18 20->27 injected 136 Creates a thread in another existing process (thread injection) 23->136 process9 dnsIp10 94 91.228.218.70, 80 VOLIA-ASUA Ukraine 27->94 96 185.49.70.90, 2080, 49711 LEASEWEB-DE-FRA-10DE United Kingdom 27->96 98 4 other IPs or domains 27->98 70 C:\Users\user\AppData\Roaming\uuuarht, PE32 27->70 dropped 72 C:\Users\user\AppData\Local\Temp\D674.exe, PE32 27->72 dropped 74 C:\Users\user\AppData\Local\Temp\CEE2.exe, PE32 27->74 dropped 76 6 other files (2 malicious) 27->76 dropped 146 System process connects to network (likely due to code injection or exploit) 27->146 148 Benign windows process drops PE files 27->148 150 Performs DNS queries to domains with low reputation 27->150 152 2 other signatures 27->152 32 BF9E.exe 14 11 27->32         started        37 CEE2.exe 27->37         started        39 D674.exe 27->39         started        41 3 other processes 27->41 file11 signatures12 process13 dnsIp14 80 swretjhwrtj.gq 104.21.86.82, 49710, 80 CLOUDFLARENETUS United States 32->80 52 C:\Users\user\...\AgileDotNetProtector.exe, PE32 32->52 dropped 54 C:\Users\user\AppData\Local\TempbehaviorgraphPU.exe, PE32+ 32->54 dropped 56 C:\Users\user\AppData\Local\Temp\CPU.exe, PE32+ 32->56 dropped 66 2 other files (none is malicious) 32->66 dropped 102 Tries to detect virtualization through RDTSC time measurements 32->102 43 AgileDotNetProtector.exe 32->43         started        104 Query firmware table information (likely to detect VMs) 37->104 106 Tries to detect sandboxes and other dynamic analysis tools (window names) 37->106 108 Hides threads from debuggers 37->108 110 Tries to detect sandboxes / dynamic malware analysis system (registry check) 37->110 48 conhost.exe 37->48         started        58 C:\Users\user\AppData\Local\...\pkzjotlj.exe, PE32 39->58 dropped 112 Detected unpacking (changes PE section rights) 39->112 114 Uses netsh to modify the Windows network and firewall settings 39->114 116 Modifies the windows firewall 39->116 82 188.34.200.103, 49713, 80 HETZNER-ASDE Germany 41->82 84 eduarroma.tumblr.com 74.114.154.22, 443, 49712 AUTOMATTICUS Canada 41->84 60 C:\Users\user\AppData\...\softokn3[1].dll, PE32 41->60 dropped 62 C:\Users\user\AppData\...\mozglue[1].dll, PE32 41->62 dropped 64 C:\Users\user\AppData\...\freebl3[1].dll, PE32 41->64 dropped 68 9 other files (none is malicious) 41->68 dropped 118 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 41->118 120 Tries to steal Crypto Currency Wallets 41->120 50 WerFault.exe 41->50         started        file15 signatures16 process17 dnsIp18 100 freegeoip.app 104.21.19.200, 443, 49715 CLOUDFLARENETUS United States 43->100 78 C:\Users\...\AgileDotNetProtector.exe.log, ASCII 43->78 dropped 154 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 43->154 156 Tries to harvest and steal browser information (history, passwords, etc) 43->156 158 Tries to steal Crypto Currency Wallets 43->158 file19 signatures20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7fefb4ac689e7334f5d66e01673dda50a293bbd7bca0bf3da972f01d32f54587/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-08-24 11:27:08 UTC
AV detection:
26 of 46 (56.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p7x3jlditzztj5ownyawopo2kcrjho6xxsql6pnjolyb2mxviwdq._file
Verdict:
malicious
Similar samples:
1b4d4888df7a07d7a2d2f9f6701b834c254548a0ed9f4602ecb114e1a92eacd4
CoinMiner
33c1310b2f87420819dce65ad5804b459650076580e9780f7a8c755ce994968d
CoinMiner
60ab0131b6fa420a6a8039b60ac948db87033e9a8db69b16344e3d9222859556
CoinMiner
87df9f2a4cfce131acf28eb02e7a12c19758050657cc5860722fb521f97ee2b6
CoinMiner
8bbb2744b45feea5115cf0da55e4bdd4eec08b4bb64992e41aca8aef68304b43
CoinMiner
c55df5e9d0ea176321a29f8957c7a43188796ae0fc0ffe1ae94ad6092d30ba77
CoinMiner
e9abbf811d367cf26f493d72ccd96749e534804ac27d36956dce0484b1440f25
CoinMiner
ecc608dedd0b55df6c75aeffcd51e11f3fd50d7422e4a1b26d4515a18419b9c4
CoinMiner
f2dc381b529cbc75c03ca8bf1886b0ee6b1e2622f8918a27a876c50889e2ae7e
CoinMiner
f74c97d626730018ba9a8dd5e6fb806bfcc42d15a8b20ef328cc5f0d6a052ccc
CoinMiner
+ 5'797 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader family:tofsee family:vidar family:xmrig botnet:824 botnet:b8ef25fa9e346b7a31e4b6ff160623dd5fed2474 botnet:fe582536ec580228180f270f7cb80a867860e010 agilenet backdoor discovery evasion infostealer miner persistence spyware stealer suricata themida trojan
Link:
https://tria.ge/reports/210824-dhab3v2my6/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Modifies system certificate store
Modifies registry class
Modifies data under HKEY_USERS
Kills process with taskkill
Delays execution with timeout.exe
Creates scheduled task(s)
Checks processor information in registry
Checks SCSI registry key(s)
Program crash
Enumerates physical storage devices
Launches sc.exe
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops file in System32 directory
Accesses cryptocurrency files/wallets, possible credential harvesting
Accesses 2FA software files, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Looks up external IP address via web service
Reads user/profile data of web browsers
Themida packer
Obfuscated with Agile.Net obfuscator
Loads dropped DLL
Deletes itself
Checks BIOS information in registry
Sets service image path in registry
Modifies Windows Firewall
Executes dropped EXE
Downloads MZ/PE file
Creates new service(s)
XMRig Miner Payload
Vidar Stealer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
xmrig
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
Windows security bypass
Vidar
Tofsee
Suspicious use of NtCreateProcessExOtherParentProcess
SmokeLoader
RedLine Payload
RedLine
Raccoon
Malware Config
C2 Extraction:
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
https://denerux.top/forum/
https://magilson.top/forum/
http://denerux.top/forum/
http://magilson.top/forum/
https://eduarroma.tumblr.com/
Unpacked files
SH256 hash:
0a9a7acf77fe4f890fe2acf761fa7f369418bb1f733504acd0792f589ccc7b15
MD5 hash:
ad94a86355be2ad9348b88e8972e8320
SHA1 hash:
8c7ff71739a5194efc5c7bee9c37ad92a9e72646
Link:
https://www.unpac.me/results/b15aab6f-aa6b-4b86-91ef-2a4721e4ec1a/
SH256 hash:
7fefb4ac689e7334f5d66e01673dda50a293bbd7bca0bf3da972f01d32f54587
MD5 hash:
651bb4e90bb174d1feabad9d8013ee36
SHA1 hash:
20a13c242d7454d8ea845734cf74f8d902bf7e80
Link:
https://www.unpac.me/results/b15aab6f-aa6b-4b86-91ef-2a4721e4ec1a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7fefb4ac689e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7fefb4ac689e7334f5d66e01673dda50a293bbd7bca0bf3da972f01d32f54587

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 7fefb4ac689e7334f5d66e01673dda50a293bbd7bca0bf3da972f01d32f54587

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1558724/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/181852/

Comments