MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 99c24686e9ac15ec6914d314a1d72dd9a1ebece08fd1b8a75e00373051e82079. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
CoinMiner
Vendor detections: 14
| SHA256 hash: | 99c24686e9ac15ec6914d314a1d72dd9a1ebece08fd1b8a75e00373051e82079 |
|---|---|
| SHA3-384 hash: | 9025b194ce1669200e04dbb5bc49bb31feab1eb41be2ced042bffb2d094ad0c0d945b362dd41318f56d77bf1669448e2 |
| SHA1 hash: | 54faa6396f179908918b4d5f1fdc4e99ad6fbb5c |
| MD5 hash: | e3dd0bfe38b07d750d2c13da80d9155d |
| humanhash: | coffee-east-april-river |
| File name: | VespyBuilder.exe |
| Download: | download sample |
| Signature | CoinMiner |
| File size: | 12'919'808 bytes |
| First seen: | 2024-01-22 20:48:35 UTC |
| Last seen: | 2024-01-22 22:20:09 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 6f462fcc6b830b77fb3fef2add9dc570 (9 x CoinMiner, 3 x BitRAT, 2 x XWorm) |
| ssdeep | 393216:HaXuGHyMeW9/MkMVEoucpzXN78c6GxrLx:H6VDe4OAIx78c6CL |
| Threatray | 32 similar samples on MalwareBazaar |
| TLSH | T1BBD63399A03E4352E9936D365725E7BB09C68FC362B3C618AFD08CC3B1F6F1A5751182 |
| TrID | 30.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 19.7% (.EXE) Win64 Executable (generic) (10523/12/4) 12.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 9.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.4% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | c069b1d96464701c (1 x CoinMiner) |
| Reporter |  e24111111111111 |
| Tags: | CoinMiner Crysan exe PureCrypt XenoRAT zgRAT |
Intelligence
File Origin
# of uploads :
2
# of downloads :
525
Origin country :
GRVendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% directory
Creating a file
Deleting a system file
Running batch commands
Unauthorized injection to a recently created process
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
coinminer packed
Verdict:
Malicious
Labled as:
FakeAlert.Generic
Result
Verdict:
MALICIOUS
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
XenoRAT
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates files with lurking names (e.g. Crack.exe)
Encrypted powershell cmdline option found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies power options to not sleep / hibernate
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Potential dropper URLs found in powershell memory
Sigma detected: Scheduled temp file as task from temp location
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected XenoRAT
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.XenoRat
Status:
Malicious
First seen:
2024-01-16 19:23:41 UTC
File Type:
PE (Exe)
Extracted files:
15
AV detection:
29 of 38 (76.32%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 22 additional samples on MalwareBazaar
Result
Malware family:
zgrat
Score:
10/10
Tags:
family:zgrat evasion persistence pyinstaller rat
Behaviour
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Detects Pyinstaller
Enumerates physical storage devices
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Creates new service(s)
Stops running service(s)
Detect ZGRat V1
ZGRat
Unpacked files
SH256 hash:
128ccee0f7eb201f9d9420880c027922cb3e2f9e39b288dfcfd807dc73ba904f
MD5 hash:
c329ed931d2729509053eb089da3ee76
SHA1 hash:
caf7675b8de63f5cbe33a2ec054bdcbf2b31afec
SH256 hash:
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db
MD5 hash:
e004a568b841c74855f1a8a5d43096c7
SHA1 hash:
b90fd74593ae9b5a48cb165b6d7602507e1aeca4
SH256 hash:
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e
MD5 hash:
d499e979a50c958f1a67f0e2a28af43d
SHA1 hash:
1e5fa0824554c31f19ce01a51edb9bed86f67cf0
SH256 hash:
99c24686e9ac15ec6914d314a1d72dd9a1ebece08fd1b8a75e00373051e82079
MD5 hash:
e3dd0bfe38b07d750d2c13da80d9155d
SHA1 hash:
54faa6396f179908918b4d5f1fdc4e99ad6fbb5c
Malware family:
XMRig
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.