MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab9a4f2751495094eb7f380d00c52e9a549eb8aaf2cc1c3280f5c3935ae57d08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab9a4f2751495094eb7f380d00c52e9a549eb8aaf2cc1c3280f5c3935ae57d08
SHA3-384 hash: 08796ee7d96a35338c8973b21fd9ca3f672ffa4ce95e8924e8063d40fcdee5ac6756deabf78129b29a12a01f6b864950
SHA1 hash: 553d20ec6bd49ab49130beb25b9534cbbc413b44
MD5 hash: bc12db6fb348790997239a6bebd3d57c
humanhash: maryland-spaghetti-six-violet
File name:file
Download: download sample
Signature CoinMiner
Create hunting rule
File size:1'797'856 bytes
First seen:2023-10-24 01:53:55 UTC
Last seen:2023-10-24 23:52:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 8a73a83fdced3fd9c55fbc1b70e551ad (6 x CoinMiner, 3 x Vidar)
ssdeep 24576:VegXZg/t9ruVTmqLiWAvVH/EqH+y1Po18zHgwK:3XZg19qb7bCvewHgr
Threatray 8 similar samples on MalwareBazaar
TLSH T170858C09F39405E9D45BC730891ADF32D3B4B45A0722DBAF1B66C6872E33AD15F3A611
TrID 83.7% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
7.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
4.4% (.EXE) Win64 Executable (generic) (10523/12/4)
2.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.8% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter andretavare5
Tags:CoinMiner exe signed

Code Signing Certificate

Organisation:Microsoft Code Signing PCA 2011
Issuer:Microsoft Code Signing PCA 2011
Algorithm:sha256WithRSAEncryption
Valid from:2023-10-24T00:08:25Z
Valid to:2024-10-24T00:08:25Z
Serial number: 25bbefc9705f6733ef4c696755da2528
Thumbprint Algorithm:SHA256
Thumbprint: 051a6a602f25b0d8a8f234e9f3753be560c5604ea8a822cd34025b46482f94bd
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from http://171.22.28.221/files/Ads.exe

Intelligence

File Origin
# of uploads :
27
# of downloads :
359
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://171.22.28.221/files/
Verdict:
Suspicious activity
Analysis date:
2023-10-24 00:49:41 UTC
Tags:
opendir loader
Link:
https://app.any.run/tasks/61d3f7fb-9e34-4e30-9e3a-8735bd88e6aa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/455796/
Detection(s):
SecuriteInfo.com.Win64.PWSX-gen.14242.9645.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Creating a window
Creating a file in the %AppData% subdirectories
Running batch commands
Launching cmd.exe command interpreter
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Enabling autorun by creating a file
Adding an exclusion to Microsoft Defender
Gathering data
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
hacktool overlay packed
Link:
https://www.filescan.io/uploads/653723bbe3768e7905c89ad5/reports/f977975b-c551-49d1-b9b3-30c07575b5b9/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/ab9a4f2751495094eb7f380d00c52e9a549eb8aaf2cc1c3280f5c3935ae57d08
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/0c5e5a92-f6c7-44fd-94ab-c39a6de8e6db
Score:
68%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/ab9a4f2751495094eb7f380d00c52e9a549eb8aaf2cc1c3280f5c3935ae57d08
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab9a4f2751495094eb7f380d00c52e9a549eb8aaf2cc1c3280f5c3935ae57d08/
Threat name:
Win64.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-10-24 01:54:06 UTC
File Type:
PE+ (Exe)
AV detection:
13 of 23 (56.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vone6j2rjfijj237hagqbrjotjkj5ofk6lgbymua6xbzgwxfpuea._file
Verdict:
malicious
Similar samples:
04d9740d54a1a12deb1a8cb0a5c1892474db2389bdd4044bafc540451bb2b6d5
CoinMiner
3869f42deb7d3c0937324b64d2ee0ef4b684f780845a1fb5324f9e498076c594
CoinMiner
402118a1fe9e2e3c12ba4e931e9e3afeeb464e0bd5cf075e926062c7a7255d87
CoinMiner
85c7ebf244cb05f624baea0b1526c57ba3ecaa05583c27fe814217f9ffbf020c
CoinMiner
c8123964a14a24724ce73744c33bfac9446e53ca0675f37c68510284f8c9ee32
CoinMiner
e08d8afc5e83a54fa0fb6c84de49af3e864ec3f362ed4e3c09459bbafba7983c
CoinMiner
e89d8af6209b99543fd2dcc8a37842d40e4d54ab8f52ce635665c432a152d8d6
CoinMiner
ed451ab9bc98df781e851bc59415edb980f7f74f940900d91cb710f22b37d27e
CoinMiner
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:glupteba family:vidar family:xmrig botnet:ecfea5e785cf6eb1f47a5865492bbbb3 discovery dropper evasion loader miner spyware stealer upx
Link:
https://tria.ge/reports/231024-cbjlfshh31/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Launches sc.exe
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Checks installed software on the system
Enumerates connected drives
Legitimate hosting services abused for malware hosting/C2
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
UPX packed file
Downloads MZ/PE file
Modifies Windows Firewall
Possible attempt to disable PatchGuard
Stops running service(s)
Modifies boot configuration data using bcdedit
XMRig Miner payload
Glupteba payload
Suspicious use of NtCreateUserProcessOtherParentProcess
Vidar
xmrig
Glupteba
Malware Config
C2 Extraction:
https://steamcommunity.com/profiles/76561199564671869
https://t.me/scubytale
Unpacked files
SH256 hash:
ab9a4f2751495094eb7f380d00c52e9a549eb8aaf2cc1c3280f5c3935ae57d08
MD5 hash:
bc12db6fb348790997239a6bebd3d57c
SHA1 hash:
553d20ec6bd49ab49130beb25b9534cbbc413b44
Link:
https://www.unpac.me/results/efd39362-8382-483f-bd61-b4735949afef/
Malware family:
Vidar.A
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ab9a4f275149/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ab9a4f2751495094eb7f380d00c52e9a549eb8aaf2cc1c3280f5c3935ae57d08

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2721934/
Cape
Cape
https://www.capesandbox.com/analysis/455796/

Comments