MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8211e981afb4ef075c4d398d21b89ee1a2e1e559b139c9d2310d97cf5303cf73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8211e981afb4ef075c4d398d21b89ee1a2e1e559b139c9d2310d97cf5303cf73
SHA3-384 hash: 4736d7d9561bfcc25000f87d4798b54148104423d6415162e5b51840f5150a7cbe40cf7dc0865bfde69800a4fe1fe6bb
SHA1 hash: cb5ce18b1d0f03fe43d900cde0987ba8c130da28
MD5 hash: e69fe04cc95b51f16bff7123da4080a2
humanhash: arizona-fifteen-juliet-mexico
File name:e69fe04cc95b51f16bff7123da4080a2
Download: download sample
Signature CoinMiner
Create hunting rule
File size:2'052'064 bytes
First seen:2021-11-19 11:49:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 02549ff92b49cce693542fc9afb10102 (84 x CoinMiner, 2 x CoinMiner.XMRig, 1 x AgentTesla)
ssdeep 49152:9jZPYdDZPBHMWy8SYuMwc8YzzCkO7Du7lNXNi8U5zD9QabN0K:DaP6Wy8JwcDzOvu5NdiDdG20
Threatray 182 similar samples on MalwareBazaar
TLSH T1569533639E95930CF87C1133B0820D02AB943B5185E0F31D6CCA5BB9657AEB5EFA0D9D
Reporter zbetcheckin
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
177
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e69fe04cc95b51f16bff7123da4080a2
Verdict:
No threats detected
Analysis date:
2021-11-19 11:57:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c5d5b631-ecdd-48cd-86c3-7da620914bb8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
Win.Malware.Generickdz-9909539-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Creating a process from a recently created file
Creating a process with a hidden window
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
donut overlay packed
Link:
https://www.filescan.io/uploads/61978f6d4912a8c920a3b03a/reports/c1a98d11-ac76-4188-88e4-deb77942e5ae/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5187fbe9-24c6-476e-a134-5f378d92c058
Result
Threat name:
BitCoin Miner
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/892615
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Drops PE files to the user root directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Svchost Process
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected BitCoin Miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 525088 Sample: C0kQ6F2qlI Startdate: 19/11/2021 Architecture: WINDOWS Score: 88 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected BitCoin Miner 2->50 52 Sigma detected: Suspicious Svchost Process 2->52 9 C0kQ6F2qlI.exe 2->9         started        12 services32.exe 2->12         started        process3 signatures4 64 Writes to foreign memory regions 9->64 66 Allocates memory in foreign processes 9->66 68 Creates a thread in another existing process (thread injection) 9->68 14 conhost.exe 5 9->14         started        70 Multi AV Scanner detection for dropped file 12->70 18 conhost.exe 5 12->18         started        20 svchost.exe 1 12->20         started        process5 file6 42 C:\Users\user\services32.exe, PE32+ 14->42 dropped 44 C:\Users\...\services32.exe:Zone.Identifier, ASCII 14->44 dropped 78 Drops PE files to the user root directory 14->78 22 cmd.exe 1 14->22         started        24 cmd.exe 1 14->24         started        46 C:\Users\user\AppData\...\sihost32.exe, PE32+ 18->46 dropped 27 sihost32.exe 18->27         started        signatures7 process8 signatures9 29 services32.exe 22->29         started        32 conhost.exe 22->32         started        54 Uses schtasks.exe or at.exe to add and modify task schedules 24->54 34 conhost.exe 24->34         started        36 schtasks.exe 1 24->36         started        56 Multi AV Scanner detection for dropped file 27->56 58 Writes to foreign memory regions 27->58 60 Allocates memory in foreign processes 27->60 62 Creates a thread in another existing process (thread injection) 27->62 38 conhost.exe 2 27->38         started        process10 signatures11 72 Writes to foreign memory regions 29->72 74 Allocates memory in foreign processes 29->74 76 Creates a thread in another existing process (thread injection) 29->76 40 conhost.exe 2 29->40         started        process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8211e981afb4ef075c4d398d21b89ee1a2e1e559b139c9d2310d97cf5303cf73/
Threat name:
Win64.Trojan.Donut
Create hunting rule
Status:
Malicious
First seen:
2021-11-19 11:50:08 UTC
AV detection:
18 of 44 (40.91%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0221c396bd17917621bb6bd04a09a07e5e00389c25677bb3af7170cb858a9ea4
CoinMiner
06b9c1418f1db6092d2f85eed6f479a667e4901accb6bbe789545c247d588232
CoinMiner
1fb1982ea5a8d329048f3ff1ac72b2050db15c8eed5e971dc9f54d1187221105
CoinMiner
d3f77ae659c38c08c8c39fde6c8e5900817e2032b5b8e96de98811b00889b486
CoinMiner
ea25ebc8bab49ffe280e8432435842e26d001fad07534b586787e72efc6e2283
CoinMiner
f3580c945b60d9f9b43c886f0f86244308c4ec859b6b3e005e5ebc2315ff0f0b
CoinMiner
fad94d50a5980d5684226b644ab844053d7b8555d27a9e9ee1ce58eadebb067a
CoinMiner
+ 172 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/211119-nzlaqsacap/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
8211e981afb4ef075c4d398d21b89ee1a2e1e559b139c9d2310d97cf5303cf73
MD5 hash:
e69fe04cc95b51f16bff7123da4080a2
SHA1 hash:
cb5ce18b1d0f03fe43d900cde0987ba8c130da28
Link:
https://www.unpac.me/results/cc946294-4be8-4cce-9200-51b6d4333d3f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8211e981afb4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/8211e981afb4ef075c4d398d21b89ee1a2e1e559b139c9d2310d97cf5303cf73

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 8211e981afb4ef075c4d398d21b89ee1a2e1e559b139c9d2310d97cf5303cf73

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/207598/

Comments


Avatar
zbet commented on 2021-11-19 11:49:59 UTC

url : hxxp://91.243.32.23:7766/sys32.exe