MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a25294daa6e96a4c39c666fe14355a0c98dc5c68fb8b6834583e598581d94c98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a25294daa6e96a4c39c666fe14355a0c98dc5c68fb8b6834583e598581d94c98
SHA3-384 hash: 7923d74e21265c96c46278b28747e77dcbe8c57cac1ad43f8ca572b786ed0dc2d755d9b30f6067a5f1d9fceb6e717744
SHA1 hash: f3099af2fd70e22fff456e8fd8219e4151ca4b31
MD5 hash: dd2868e00b26cbc49cbf54d4a38496f5
humanhash: sweet-bacon-helium-early
File name:a25294daa6e96a4c39c666fe14355a0c98dc5c68fb8b6834583e598581d94c98
Download: download sample
File size:2'473'083 bytes
First seen:2020-11-07 19:15:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4290fa6afc89d56616f34ebbd0b1f2c (50 x CoinMiner)
ssdeep 49152:Lz071uv4BjMkibTIA5lCx7kvRWa4pXHafMiGoE:NABr
Threatray 105 similar samples on MalwareBazaar
TLSH A0B5331B4E3D5A3ECAB8247D287D0F0E0690CE458004BDB5A7E339AF2A5DFBD114E15A
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
50
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Coinminer-7331384-0
Create hunting rule

Win.Trojan.Coinminer-7331970-0
Create hunting rule

Win.Trojan.Coinminer-7331971-0
Create hunting rule

Win.Trojan.Coinminer-7332650-0
Create hunting rule

Win.Trojan.Coinminer-7332688-0
Create hunting rule

Win.Trojan.Coinminer-7332725-0
Create hunting rule

Win.Trojan.Coinminer-7332745-0
Create hunting rule

Win.Trojan.Coinminer-9670639-0
Create hunting rule

Win.Trojan.Coinminer-9787657-0
Create hunting rule

Win.Trojan.Coinminer-9787666-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Launching a process
Creating a process from a recently created file
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a25294daa6e96a4c39c666fe14355a0c98dc5c68fb8b6834583e598581d94c98/
Gathering data
Verdict:
malicious
Similar samples:
17951136d0013f019008ac6efbef0a7e07191f8b9d1437a8f2288bdabaef12df
3917659714f9e7002c2ee4609034c29611fd9004722f7ded813b7677e2b23f40
418cc6f42a9c585548d8f02ca7c605723b657172483b904c35ccd69a8bf62c6c
5265c96f002b8bb39fff474221996cbb4661d5963dc243202c5266b09886d33a
5ec2a270a9b0e335fb6ecf9d313e02771acad023d7a1a6168a15297d1f80312d
68dc7c7dfdac09078ca6c904bedaa8975a5c1f06390dfdffffed453d75474014
6ca54d07235739dc0ff481344f7d87c465fc223b2197d68c69a98806153e6aa9
aed1ec82acd83e514cab79421231da4075fa9a31efe802436814dda0903590e5
b9c14334edff8f0afc962b3838680e07ed7d4ee354c73361e8b767d31a110bc7
c141c25789fb6d9ba283cf8b8657c97894132c998e91e2ff3dc79e9585addafe
+ 95 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201108-cabmxykcl6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Drops file in Windows directory
Loads dropped DLL
Executes dropped EXE
UPX packed file
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments