🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad1e39076212d8d58ff45d1e24d681fe0c600304bd20388cddcf9182b1d28c2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad1e39076212d8d58ff45d1e24d681fe0c600304bd20388cddcf9182b1d28c2f
SHA3-384 hash: c9a41c37eee7b42f71a97e2b3f53430dbf6604fb3ef4b5739a70aa2ec8f0047aae359a125cc88541c5e2e62989364c51
SHA1 hash: bdc36bc233675e7a96faa2c4917e9b756cc2a2a0
MD5 hash: 5c13ee5dbe45d02ed74ef101b2e82ae6
humanhash: virginia-quebec-fanta-september
File name:010D0060.mlw
Download: download sample
Signature CoinMiner
Create hunting rule
File size:409'600 bytes
First seen:2022-07-22 14:32:43 UTC
Last seen:2022-07-22 16:56:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d47e7613185268ac6deec2ce8f67e2c3 (1 x CoinMiner)
ssdeep 12288:CHJfYhK0bUticPtFZboqWIN+hKyDvp7fcMFEWBCcFtzU:CJWu+pFEsTFtU
Threatray 7 similar samples on MalwareBazaar
TLSH T15C948E21B956D071D6A001B01E7EFF7695ADAC244B610ACB77D01E789E312E37632F3A
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter johannes
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
433
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/293425/
Detection(s):
SecuriteInfo.com.Trojan.Siggen18.16781.9907.17272.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Modifying a system executable file
Searching for the window
Creating a window
Changing a file
Launching a service
Searching for synchronization primitives
Sending a custom TCP request
Forced shutdown of a system process
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/27063/overview
Behaviour
MalwareBazaar
CallSleep
MeasuringTime
EnumerateProcesses
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware shell32.dll
Link:
https://www.filescan.io/uploads/62dab59e7b83f958a96c439a/reports/5d56c362-6bb5-4319-9cfb-def52f53ef20/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/862c98b4-9de6-402e-a6d7-ddc2111b9a00
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1039299
Signature
Allocates memory in foreign processes
Changes security center settings (notifications, updates, antivirus, firewall)
Connects to many ports of the same IP (likely port scanning)
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Detected Stratum mining protocol
Drops PE files to the startup folder
Found evasive API chain (may stop execution after checking mutex)
Found evasive API chain checking for user administrative privileges
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to resolve many domain names, but no domain seems valid
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 671793 Sample: 010D0060.mlw Startdate: 22/07/2022 Architecture: WINDOWS Score: 100 42 Snort IDS alert for network traffic 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 8 other signatures 2->48 7 010D0060.exe 15 2->7         started        12 svchost.exe 2->12         started        14 explorer.exe 13 161 2->14         started        16 10 other processes 2->16 process3 dnsIp4 32 ojena.duckdns.org 7->32 34 ff5f8903.org 7->34 40 34 other IPs or domains 7->40 28 C:\Users\user\AppData\...\vvvnnnqqquuu.exe, PE32+ 7->28 dropped 54 Found evasive API chain (may stop execution after checking mutex) 7->54 56 Drops PE files to the startup folder 7->56 58 Contains functionality to inject code into remote processes 7->58 64 5 other signatures 7->64 18 gpscript.exe 7->18         started        60 Changes security center settings (notifications, updates, antivirus, firewall) 12->60 22 MpCmdRun.exe 12->22         started        24 vvvnnnqqquuu.exe 14->24         started        36 127.0.0.1 unknown unknown 16->36 38 192.168.2.1 unknown unknown 16->38 file5 62 Tries to resolve many domain names, but no domain seems valid 34->62 signatures6 process7 dnsIp8 30 45.61.187.7, 49804, 7733 PONYNETUS United States 18->30 50 Query firmware table information (likely to detect VMs) 18->50 26 conhost.exe 22->26         started        signatures9 52 Detected Stratum mining protocol 30->52 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad1e39076212d8d58ff45d1e24d681fe0c600304bd20388cddcf9182b1d28c2f/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2022-07-11 18:42:48 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vupdsb3cclmnld7ulupcjvub7yggaayexuqdrdg5z6iyfmosrqxq._file
Verdict:
malicious
Similar samples:
0b75e2fadffc45dff940e58f5b6f8d99832426bb880f432f98d853308b29c9c5
CoinMiner
2c1cfaeb1cb2168477f7e90e671a7ba182cb95b4845c0cf4c44f5809edcd5cc2
CoinMiner
51037666d1982db93e3123e88594d409805d3f1d970e9f926dcadb99f77f50f6
CoinMiner
be39a79adbc892815b56c1734f0af24ec909a58616a248b06e34de82de92a976
CoinMiner
cc87729bab09fd3d13ceb36c1ea3ed112e7c1713a640ac4533c6f60f1a9640ba
CoinMiner
edb86e9c3d29b3d13c82562dc1aeb1cd7e2c33e2bfcbae30791bf1d1aaf4345f
CoinMiner
f1fb6f4482571a4429e7ef7c75595303ac6c8367023d725dd3021db1015c3221
CoinMiner
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig miner persistence
Link:
https://tria.ge/reports/220722-rwtz9agaap/
Behaviour
Checks SCSI registry key(s)
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Enumerates connected drives
Drops startup file
Modifies Installed Components in the registry
XMRig Miner payload
xmrig
Unpacked files
SH256 hash:
ad1e39076212d8d58ff45d1e24d681fe0c600304bd20388cddcf9182b1d28c2f
MD5 hash:
5c13ee5dbe45d02ed74ef101b2e82ae6
SHA1 hash:
bdc36bc233675e7a96faa2c4917e9b756cc2a2a0
Link:
https://www.unpac.me/results/22ebb5a1-d6fd-424c-8a74-ac7e134890a5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ad1e39076212d8d58ff45d1e24d681fe0c600304bd20388cddcf9182b1d28c2f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:MALWARE_Win_CoinMiner02
Create hunting rule
Author:ditekSHen
Description:Detects coinmining malware
Rule name:MAL_XMR_Miner_May19_1
Create hunting rule
Author:Florian Roth
Description:Detects Monero Crypto Coin Miner
Reference:https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Rule name:MAL_XMR_Miner_May19_1_RID2E1B
Create hunting rule
Author:Florian Roth
Description:Detects Monero Crypto Coin Miner
Reference:https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Rule name:rig_win64_xmrig_6_13_1_xmrig
Create hunting rule
Author:yarGen Rule Generator
Description:rig_win64 - file xmrig.exe
Reference:https://github.com/Neo23x0/yarGen

File information

The table below shows additional information about this malware sample such as delivery method and external references.

CoinMiner

Executable exe 2e63bbbbbb11c21445885f85fc8ef398737184c603f365c8e77a8cbf7523cac9

CoinMiner

Executable exe ad1e39076212d8d58ff45d1e24d681fe0c600304bd20388cddcf9182b1d28c2f

(this sample)

CoinMiner

Executable exe 2e63bbbbbb11c21445885f85fc8ef398737184c603f365c8e77a8cbf7523cac9

  
Dropped by
MD5 077b6b101cccb3d77a98e2cc02003526
  
Dropping
SHA256 2e63bbbbbb11c21445885f85fc8ef398737184c603f365c8e77a8cbf7523cac9
Cape
Cape
https://www.capesandbox.com/analysis/293425/
  
Dropped by
SHA256 2e63bbbbbb11c21445885f85fc8ef398737184c603f365c8e77a8cbf7523cac9

Comments