MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c8314de1486634c7612198f144f80cba26a2f79a65b657b6f17af33491c0998. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c8314de1486634c7612198f144f80cba26a2f79a65b657b6f17af33491c0998
SHA3-384 hash: 441e5bba9aa57485842262c5516ac581a6898cbc67419d4efc4209af75bf81f9ad059fbcc30a39961c44bcbf8a7f4304
SHA1 hash: 759e35a38589f87960c5c008800e3710673142a4
MD5 hash: b8a95e40b69acb6789b7f2b6bff73cf3
humanhash: item-twelve-louisiana-cardinal
File name:9c8314de1486634c7612198f144f80cba26a2f79a65b6.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:2'629'050 bytes
First seen:2022-02-25 22:20:39 UTC
Last seen:2022-03-24 05:57:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9c61e193ad83beb9c6707bb817822229 (5 x RedLineStealer, 1 x Pony, 1 x CoinMiner)
ssdeep 49152:YNYk/eVd2iMRlze6HynO/hqdrZZohyM2V+PpP29+ocPuAU:YNVu2iMRlze0yE6rvYPtU
Threatray 1'965 similar samples on MalwareBazaar
TLSH T190C5337177E598BEF24326B3A881777939F6F8255F0402C3DB20500BBD442E99A794EB
File icon (PE):PE icon
dhash icon 6192a6a6a6a6c401 (17 x RedLineStealer, 11 x PythonStealer, 9 x DCRat)
Reporter abuse_ch
Tags:CoinMiner exe


Avatar
abuse_ch
CoinMiner C2:
46.8.153.100:81

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
46.8.153.100:81 https://threatfox.abuse.ch/ioc/390916/

Intelligence

File Origin
# of uploads :
3
# of downloads :
311
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/244821/
Detection(s):
SecuriteInfo.com.Variant.Strictor.269665.691.27522.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Moving a file to the %temp% subdirectory
Creating a process from a recently created file
Replacing files
Enabling the 'hidden' option for files in the %temp% directory
Sending a custom TCP request
DNS request
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/7434/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
strictor
Link:
https://www.filescan.io/uploads/62195650b94fb38cb40a2618/reports/19b42f3e-c226-4cad-b481-414ef27c8e27/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/29d5316d-00ff-413d-ad72-5e03303d253e
Result
Threat name:
RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/946589
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to register a low level keyboard hook
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 579070 Sample: 9c8314de1486634c7612198f144... Startdate: 25/02/2022 Architecture: WINDOWS Score: 100 35 casi.bet 2->35 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Antivirus detection for URL or domain 2->51 53 8 other signatures 2->53 8 9c8314de1486634c7612198f144f80cba26a2f79a65b6.exe 7 2->8         started        signatures3 process4 file5 25 C:\Users\user\AppData\Local\Temp\...\7z.exe, PE32+ 8->25 dropped 27 C:\Users\user\AppData\Local\Temp\...\7z.dll, PE32+ 8->27 dropped 55 Contains functionality to register a low level keyboard hook 8->55 12 cmd.exe 2 8->12         started        signatures6 process7 process8 14 741716679.exe 15 4 12->14         started        19 7z.exe 2 12->19         started        21 7z.exe 3 12->21         started        23 10 other processes 12->23 dnsIp9 37 46.8.153.100, 49768, 81 DATACHEAP-LLC-ASRU Russian Federation 14->37 39 api.ip.sb 14->39 29 C:\Users\user\AppData\Local\Temp\build.exe, PE32 14->29 dropped 31 C:\Users\user\AppData\Local\Tempbehaviorgrapho.exe, PE32+ 14->31 dropped 41 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 14->41 43 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 14->43 45 Tries to harvest and steal browser information (history, passwords, etc) 14->45 33 C:\Users\user\AppData\Local\...\741716679.exe, PE32 19->33 dropped file10 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9c8314de1486634c7612198f144f80cba26a2f79a65b657b6f17af33491c0998/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2022-02-23 18:39:00 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
16 of 43 (37.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tsbrjxquqzruy5qsdghrit4azorgul3zuznwk63pc6xtgsi4bgma._file
Verdict:
malicious
Similar samples:
1660fa277deb0f1afcd706189ecca08930050458121c2a2f42f2dcdeb1cf9c29
CoinMiner
3aa4c3f9f304b65aba7f2914662f922139ff5417a1cb7ddd5c26ace6685474ba
CoinMiner
92d30855da0de535afe7d2b432108880f5d3766767c09c493defcb6c05c10448
CoinMiner
9fe2c85a1401d69c00fcecc28fbe3e0ae8c190ae32512fe4cd61bea320528a3b
CoinMiner
bcede46445b13b3def4d8363b1365903a72f3ed6c09ff078bd3a090f65ed0937
CoinMiner
f303ccc5cdf05114cedee459d0f66bf3b428e19054e2e3f1f001d945332ab6c0
CoinMiner
+ 1'955 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:redline family:xmrig botnet:741716679 discovery infostealer miner spyware stealer
Link:
https://tria.ge/reports/220225-19nvtshcf4/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
XMRig Miner Payload
RedLine
RedLine Payload
Suspicious use of NtCreateProcessExOtherParentProcess
xmrig
Malware Config
C2 Extraction:
46.8.153.100:81
Unpacked files
SH256 hash:
38afde82f9b29aae50217bcf62a389e38ea4c3c56033482ce86d1ff065fd2219
MD5 hash:
330e9830fcb0a91d131239cac4b22f6e
SHA1 hash:
640b048e1fb9ea96ae2afbd6adeaa379e863799c
Link:
https://www.unpac.me/results/ca6e505d-e990-45cd-a8af-4abc82fa2c61/
SH256 hash:
9c8314de1486634c7612198f144f80cba26a2f79a65b657b6f17af33491c0998
MD5 hash:
b8a95e40b69acb6789b7f2b6bff73cf3
SHA1 hash:
759e35a38589f87960c5c008800e3710673142a4
Link:
https://www.unpac.me/results/ca6e505d-e990-45cd-a8af-4abc82fa2c61/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9c8314de1486634c7612198f144f80cba26a2f79a65b657b6f17af33491c0998

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/244821/

Comments