MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa117cef07965590ed3e520cb735b0c1b614b8a43b9df780f2992b4a5761c276. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa117cef07965590ed3e520cb735b0c1b614b8a43b9df780f2992b4a5761c276
SHA3-384 hash: 5c1db90303c3524d94ed81501c3f32e393e7bc8b7897474d220adfed3202e5cb2dea0e13aed11c9017d01296551e1e4a
SHA1 hash: b9a977d1bcfc791855ac69d2e5c7088fda285b5f
MD5 hash: 2d26986edfe404360d5544b0ec99bf78
humanhash: london-low-kansas-mexico
File name:aa117cef07965590ed3e520cb735b0c1b614b8a43b9df780f2992b4a5761c276
Download: download sample
File size:1'851'462 bytes
First seen:2020-11-07 20:17:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4290fa6afc89d56616f34ebbd0b1f2c (50 x CoinMiner)
ssdeep 49152:Lz071uv4BWMkibTIA5lCx7kvRWa4p1HzDgU7ybn:NABX
Threatray 104 similar samples on MalwareBazaar
TLSH 4D8533595E5E1C7ECAE8213C24BD0F0F81A1DF528148DD78E3F6354B2A6DBAD125F20A
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Coinminer-7331384-0
Create hunting rule

Win.Malware.Eati-7331635-0
Create hunting rule

Win.Trojan.Coinminer-7331970-0
Create hunting rule

Win.Trojan.Coinminer-7331971-0
Create hunting rule

Win.Trojan.Coinminer-7332650-0
Create hunting rule

Win.Trojan.Coinminer-7332688-0
Create hunting rule

Win.Trojan.Coinminer-7332689-0
Create hunting rule

Win.Trojan.Coinminer-7332725-0
Create hunting rule

Win.Trojan.Coinminer-7332745-0
Create hunting rule

Win.Trojan.Coinminer-9670639-0
Create hunting rule

Win.Trojan.Coinminer-9787657-0
Create hunting rule

Win.Trojan.Coinminer-9787666-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Launching a process
Creating a process from a recently created file
Creating a window
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa117cef07965590ed3e520cb735b0c1b614b8a43b9df780f2992b4a5761c276/
Threat name:
Win64.Trojan.CoinMiner
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 20:39:08 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
17951136d0013f019008ac6efbef0a7e07191f8b9d1437a8f2288bdabaef12df
5ec2a270a9b0e335fb6ecf9d313e02771acad023d7a1a6168a15297d1f80312d
79358bd800eb2a907193bc1f9595b465ab22c1f1d7b562c0ceb6af3ce5e2e144
7c90b8058b4d24a684a48b18978657af2e14fbbc11117193c2c244983b607be5
89d5d36ce9e1a8119729880250f8a3ce47f878c0b1164a62e9ae5751ca0d8b36
99a195a691e9d13e10c9ba4289042e1c224f278d96fffa362181899aa10e83ac
a170fe6e3f24d59751b8db1a95f124f9a58f410e20d7766dcf979d440334d1b7
c583e1aae343cd8385c6bba4f175025eba86a0674cb7140bbbaf017fc0f53e6b
c7c51b4c380b59c364a3ec2bad5e69139c662ae2cf8e920954d2cb01b512c8fd
c812e5ad7a74debc0ffb38bbce9ec319ebc47b5fe77c353a0e51d36b1a44fc43
+ 94 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201108-xcxkeyfb3x/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Drops file in Windows directory
Loads dropped DLL
Executes dropped EXE
UPX packed file
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments