MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88af1e9043d969296da2fba89cfe6d2cd01174d2fcc5c78d63d90191704b8e90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner.XMRig


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88af1e9043d969296da2fba89cfe6d2cd01174d2fcc5c78d63d90191704b8e90
SHA3-384 hash: 91371bec42ab819afd781830acd467e1e6ddcd63f81f070f529a8e14f5328e07d445cea9efd096fdc8a6a757454af06b
SHA1 hash: 33b7f58239616858134202f37a472cb6c5130b2d
MD5 hash: 2d56e702d2c44d699a03e239df8cd36c
humanhash: kitten-salami-berlin-avocado
File name:2d56e702d2c44d699a03e239df8cd36c.exe
Download: download sample
Signature CoinMiner.XMRig
Create hunting rule
File size:1'062'040 bytes
First seen:2022-08-12 10:31:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9ff18e32788395b57acd45d941688b9b (5 x RedLineStealer, 1 x AgentTesla, 1 x CoinMiner.XMRig)
ssdeep 24576:v6siaRLnAmG+ZL65CYCgRpGikN/SfL8WmK:ZAASfwHK
TLSH T13E35CEB8AEDCC2B7CA6160396E24D63342EB3AF049109483F695CD7D4F772A1452CF66
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:CoinMiner.XMRig exe


Avatar
abuse_ch
CoinMiner.XMRig C2:
185.148.39.219:47029

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.148.39.219:47029 https://threatfox.abuse.ch/ioc/842716/

Intelligence

File Origin
# of uploads :
1
# of downloads :
385
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
2d56e702d2c44d699a03e239df8cd36c.exe
Verdict:
Malicious activity
Analysis date:
2022-08-12 10:33:43 UTC
Tags:
trojan rat redline
Link:
https://app.any.run/tasks/0b8c3862-acbc-45a7-872c-11b458c0a98b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/298212/
Detection(s):
Win.Keylogger.Fugrafa-9961671-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/28789/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/62f62c9e810e2831b73d34a9/reports/7e33576e-ef6d-4c88-adf1-75222aae3499/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/43a34e44-4ab0-4a01-ad32-e031540202b9
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1050515
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Suspicious powershell command line found
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 683025 Sample: AzhR79Qfgx.exe Startdate: 12/08/2022 Architecture: WINDOWS Score: 100 56 litrazalilibe.xyz 2->56 58 api.ip.sb 2->58 60 2 other IPs or domains 2->60 76 Snort IDS alert for network traffic 2->76 78 Malicious sample detected (through community Yara rule) 2->78 80 Antivirus / Scanner detection for submitted sample 2->80 82 9 other signatures 2->82 12 AzhR79Qfgx.exe 1 2->12         started        signatures3 process4 signatures5 102 Contains functionality to inject code into remote processes 12->102 104 Writes to foreign memory regions 12->104 106 Allocates memory in foreign processes 12->106 108 Injects a PE file into a foreign processes 12->108 15 AppLaunch.exe 15 10 12->15         started        20 conhost.exe 12->20         started        process6 dnsIp7 64 185.106.92.139, 16578, 49739 SUPERSERVERSDATACENTERRU Russian Federation 15->64 66 cdn.discordapp.com 162.159.133.233, 443, 49755, 49756 CLOUDFLARENETUS United States 15->66 48 C:\Users\user\AppData\Local\Temp\vvv.exe, PE32 15->48 dropped 50 C:\Users\user\AppData\Local\...\updater.exe, PE32 15->50 dropped 52 C:\Users\user\AppData\...\services64.exe, PE32+ 15->52 dropped 68 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 15->68 70 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 15->70 72 Tries to harvest and steal browser information (history, passwords, etc) 15->72 74 Tries to steal Crypto Currency Wallets 15->74 22 updater.exe 2 15->22         started        26 services64.exe 3 15->26         started        28 vvv.exe 15->28         started        file8 signatures9 process10 file11 54 C:\Users\user\AppData\Local\Temp\44620.exe, PE32 22->54 dropped 90 Antivirus detection for dropped file 22->90 92 Multi AV Scanner detection for dropped file 22->92 94 Suspicious powershell command line found 22->94 30 powershell.exe 15 22->30         started        96 Machine Learning detection for dropped file 26->96 98 Encrypted powershell cmdline option found 26->98 32 powershell.exe 26->32         started        100 Tries to detect virtualization through RDTSC time measurements 28->100 34 conhost.exe 28->34         started        signatures12 process13 process14 36 44620.exe 30->36         started        40 conhost.exe 30->40         started        42 conhost.exe 32->42         started        dnsIp15 62 127.0.0.1 unknown unknown 36->62 84 Antivirus detection for dropped file 36->84 86 Multi AV Scanner detection for dropped file 36->86 88 Adds a directory exclusion to Windows Defender 36->88 44 powershell.exe 36->44         started        signatures16 process17 process18 46 conhost.exe 44->46         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88af1e9043d969296da2fba89cfe6d2cd01174d2fcc5c78d63d90191704b8e90/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-08-08 16:26:05 UTC
File Type:
PE (Exe)
AV detection:
23 of 25 (92.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rcxr5ecd3fuss3nc7oujz7tnftibc5gs7tc4pdld3eazc4clr2ia._file
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:redline botnet:@moriwws botnet:whymelol123 discovery evasion exploit infostealer spyware
Link:
https://tria.ge/reports/220812-mkyf3scbbl/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks computer location settings
Loads dropped DLL
Modifies file permissions
Possible privilege escalation attempt
Stops running service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies security service
RedLine
RedLine payload
Malware Config
C2 Extraction:
185.106.92.139:16578
193.106.191.106:26883
185.186.142.127:17355
5.182.39.50:6737
193.106.191.160:8673
185.148.39.219:47029
litrazalilibe.xyz:81
Unpacked files
SH256 hash:
0274592d151007eaad1a10de4b124fbae28ca9ed052e0ae03688a99ca59759b4
MD5 hash:
ee4e7258c4b99e2963eb4aaf20b92fff
SHA1 hash:
05b9cb1f883354b502cf1f975f01ecae5539ed05
Link:
https://www.unpac.me/results/bcc58ad0-2c5e-41dc-a287-094eca451478/
SH256 hash:
88af1e9043d969296da2fba89cfe6d2cd01174d2fcc5c78d63d90191704b8e90
MD5 hash:
2d56e702d2c44d699a03e239df8cd36c
SHA1 hash:
33b7f58239616858134202f37a472cb6c5130b2d
Link:
https://www.unpac.me/results/bcc58ad0-2c5e-41dc-a287-094eca451478/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/88af1e9043d9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/88af1e9043d969296da2fba89cfe6d2cd01174d2fcc5c78d63d90191704b8e90

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RedLine
Create hunting rule
Author:ditekSHen
Description:Detects RedLine infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/298212/

Comments