MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 914644da1b2f5c041a3199411b353f3c8e5b7e965399ac015bbc6c5286da7a7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
CoinMiner
Vendor detections: 11
| SHA256 hash: | 914644da1b2f5c041a3199411b353f3c8e5b7e965399ac015bbc6c5286da7a7e |
|---|---|
| SHA3-384 hash: | 70430025618d21d525f4dc609252bf56aff98916ea51d689055be7fec365a709aa1fbbd9554653ad42a5d3521b57adff |
| SHA1 hash: | 3f1549e8aaea2119361caa588d47de42aab0dc47 |
| MD5 hash: | c884991c01d2854cd2d9b46f792207fc |
| humanhash: | charlie-thirteen-harry-maine |
| File name: | VAPE CRACK.exe |
| Download: | download sample |
| Signature | CoinMiner |
| File size: | 7'655'424 bytes |
| First seen: | 2021-10-23 17:23:30 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | d59a4a699610169663a929d37c90be43 (75 x DCRat, 22 x njrat, 15 x SalatStealer) |
| ssdeep | 196608:9dm5Fdkyzf/xH8YRE4iQOr3asgZ9QHfz1afuVClmlB:9gPuybp5E4zO9Rc5ly |
| Threatray | 6 similar samples on MalwareBazaar |
| TLSH | T19C762323B5590454D2E6CD36493FFE9132FA62354B42ACFB6AC95CC13A361F0E326A53 |
| Reporter | Anonymous |
| Tags: | CoinMiner exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
644
Origin country :
n/a
Vendor Threat Intelligence
Detection:
EnigmaStub
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Verdict:
Malicious
Threat name:
Win32.Trojan.Delf
Status:
Malicious
First seen:
2021-10-22 15:36:05 UTC
AV detection:
26 of 27 (96.30%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
Result
Malware family:
xmrig
Score:
10/10
Tags:
family:loaderbot family:redline family:xmrig botnet:@zenvolord infostealer loader miner persistence spyware vmprotect
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Drops startup file
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
VMProtect packed file
XMRig Miner Payload
LoaderBot
RedLine
RedLine Payload
Suspicious use of NtCreateProcessExOtherParentProcess
xmrig
Malware Config
C2 Extraction:
185.209.22.181:29234
Unpacked files
SH256 hash:
860eabc945b4a99255e1bdbcfcc19a6ebf605612d809678ecd329e6f17c4f961
MD5 hash:
eda712f5cca6547e36d2937b9d89fad0
SHA1 hash:
fb036b0995196539788ad0bcbce0bbb8d2db448e
SH256 hash:
af59c04fb781e627d9790ee4530f8fb8649ce78de999a09f91ea5213fb1f1fb5
MD5 hash:
e440cf5bbc95290a3eac667deb1ca47e
SHA1 hash:
11ff4eaf4ce2d182912db6d2f5ebeffe31cbfeaa
SH256 hash:
914644da1b2f5c041a3199411b353f3c8e5b7e965399ac015bbc6c5286da7a7e
MD5 hash:
c884991c01d2854cd2d9b46f792207fc
SHA1 hash:
3f1549e8aaea2119361caa588d47de42aab0dc47
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.