MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90e4fd2f0792a3068a2048c3dd0fd42e1f7e4da082d76cbe52989757a4a987d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 90e4fd2f0792a3068a2048c3dd0fd42e1f7e4da082d76cbe52989757a4a987d5
SHA3-384 hash: 54a57c92a39f216312d53db94f7acbd4eb0b7b58ba8608f71e6068e1be42a4f49e707195945745115f1542c50046c81e
SHA1 hash: fcd17baf5894cede249211bab735f97d8f6b5770
MD5 hash: 386382628bdab18db3b929a566756da5
humanhash: music-arkansas-asparagus-golf
File name:386382628bdab18db3b929a566756da5
Download: download sample
Signature CoinMiner
Create hunting rule
File size:16'723'456 bytes
First seen:2021-10-16 14:30:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 393216:gX+Ip+eLGEPexfSx3P/2ey6O/w/fDQnQj4cphWkBZU7A2:fIoEZPepShPOeldsQj4cphNBb2
Threatray 1'281 similar samples on MalwareBazaar
TLSH T130F63312A3E5C032FFA792739B99B20492B87D658063853F27581EAEBD702B1137D753
File icon (PE):PE icon
dhash icon aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter zbetcheckin
Tags:32 CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
554
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
386382628bdab18db3b929a566756da5
Verdict:
Malicious activity
Analysis date:
2021-10-16 14:32:02 UTC
Tags:
evasion
Link:
https://app.any.run/tasks/ec49ec75-6578-4fa8-8f8b-eed2403c5083

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Deleting a recently created file
Using the Windows Management Instrumentation requests
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
autoit greyware hacktool keylogger packed
Link:
https://www.filescan.io/uploads/616ae22ca9d585e6d52af87d/reports/0f905beb-b436-4473-9dfb-a0fdac59c47e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dee17d42-84fa-4769-b501-c58245b99e0c
Result
Threat name:
BitCoin Miner
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/871599
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
AutoIt script contains suspicious strings
Binary is likely a compiled AutoIt script file
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
May use the Tor software to hide its network traffic
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected BitCoin Miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 504023 Sample: GGoaWcrbrB Startdate: 16/10/2021 Architecture: WINDOWS Score: 100 71 Antivirus detection for dropped file 2->71 73 Antivirus / Scanner detection for submitted sample 2->73 75 Multi AV Scanner detection for dropped file 2->75 77 7 other signatures 2->77 8 Helper.exe 1 2->8         started        11 GGoaWcrbrB.exe 7 2->11         started        15 Helper.exe 1 2->15         started        17 3 other processes 2->17 process3 dnsIp4 85 Antivirus detection for dropped file 8->85 87 Multi AV Scanner detection for dropped file 8->87 89 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->89 19 Helper.exe 5 8->19         started        69 2no.co 88.99.66.31, 443, 49748 HETZNER-ASDE Germany 11->69 49 C:\Users\user\AppData\Roaming\...\Helper.exe, PE32+ 11->49 dropped 51 C:\Users\user\AppData\...\SystemCheck.xml, XML 11->51 dropped 53 C:\Users\user\AppData\...\CL_Debug_Log.txt, PE32 11->53 dropped 91 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->91 22 CL_Debug_Log.txt 3 11->22         started        25 cmd.exe 1 11->25         started        27 Helper.exe 15->27         started        file5 signatures6 process7 file8 79 Modifies the context of a thread in another process (thread injection) 19->79 81 Injects a PE file into a foreign processes 19->81 29 Helper.exe 11 19->29         started        32 tor.exe 6 19->32         started        45 C:\Users\user\AppData\Local\Temp\64.exe, PE32+ 22->45 dropped 47 C:\Users\user\AppData\Local\Temp\32.exe, PE32 22->47 dropped 35 conhost.exe 22->35         started        83 Uses schtasks.exe or at.exe to add and modify task schedules 25->83 37 conhost.exe 25->37         started        39 schtasks.exe 1 25->39         started        signatures9 process10 dnsIp11 55 C:\Users\user\AppData\Roaming\...\tor.exe, PE32+ 29->55 dropped 57 C:\Users\user\AppData\Roaming\...\zlib1.dll, PE32+ 29->57 dropped 59 C:\Users\user\AppData\...\libwinpthread-1.dll, PE32+ 29->59 dropped 61 7 other files (none is malicious) 29->61 dropped 41 conhost.exe 29->41         started        63 212.47.233.86, 9101 OnlineSASFR France 32->63 65 5.199.142.236, 9001 MYLOC-ASIPBackboneofmyLocmanagedITAGDE Germany 32->65 67 4 other IPs or domains 32->67 43 Helper.exe 35->43         started        file12 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/90e4fd2f0792a3068a2048c3dd0fd42e1f7e4da082d76cbe52989757a4a987d5/
Threat name:
Win32.Dropper.Nymeria
Create hunting rule
Status:
Malicious
First seen:
2021-10-16 13:45:22 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sdsp2lyhskrqncrajdb52d6ufypx4tnaqllwzpsstclvpjfjq7kq._file
Verdict:
unknown
Similar samples:
29e852d6a556df006e46464f0b601724a91d72909ac519d0d013c3bd9a6c6bc1
CoinMiner
3b7d5786e440b36bd5a12e1293465683353c7dd3b843eef7a0313b7a0245ccc2
CoinMiner
586871a8aa5c08be02631a432daa373d9e40fdd0dd53b80f0210f53b41dbbfb3
CoinMiner
7b579694a738437eb6aed2064bd2d78cb77d8afe92994bf6e02016a563cd50a3
CoinMiner
7ca02cae9a6b34b146678118ee4e44d3c703dfbaad081db7dea5325eb0a59d5e
CoinMiner
9a0d57d82e15f4f45a2442d1d5355242a0fe4684039777025622dfa95a8caeec
CoinMiner
b96c79ff7e741638ee99fc0461688440276bdb9df395d5325915408efd174876
CoinMiner
e89843256ff5ba727b9195361447d30e88fbfb660e97aaad5cb0196fd2f0991a
CoinMiner
+ 1'271 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig miner suricata
Link:
https://tria.ge/reports/211016-rvqanscghn/
Behaviour
Creates scheduled task(s)
NTFS ADS
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Drops file in System32 directory
Suspicious use of SetThreadContext
autoit_exe
Loads dropped DLL
Executes dropped EXE
Detected Stratum cryptominer command
XMRig Miner Payload
suricata: ET MALWARE Win32/MOOZ.THCCABO CoinMiner CnC Checkin
xmrig
Unpacked files
SH256 hash:
c5867da958432d7df291663211325ae4f824adb5b61c3393b674f84e937f37e6
MD5 hash:
c422ae987337f66473876f72a8c5e9a8
SHA1 hash:
31f4e957224f858d878d39a531b613904f8092eb
Link:
https://www.unpac.me/results/18cc0bc5-5cc4-4efa-ab02-69d03de2c0c5/
SH256 hash:
90e4fd2f0792a3068a2048c3dd0fd42e1f7e4da082d76cbe52989757a4a987d5
MD5 hash:
386382628bdab18db3b929a566756da5
SHA1 hash:
fcd17baf5894cede249211bab735f97d8f6b5770
Link:
https://www.unpac.me/results/18cc0bc5-5cc4-4efa-ab02-69d03de2c0c5/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/90e4fd2f0792/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/90e4fd2f0792a3068a2048c3dd0fd42e1f7e4da082d76cbe52989757a4a987d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 90e4fd2f0792a3068a2048c3dd0fd42e1f7e4da082d76cbe52989757a4a987d5

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1685121/

Comments


Avatar
zbet commented on 2021-10-16 14:30:42 UTC

url : hxxp://a0588827.xsph.ru/start.exe