MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0bb8d472e211ec652e3a2658a2deb3a42cb5aff9f97ce6aeeb01813a7063dac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b0bb8d472e211ec652e3a2658a2deb3a42cb5aff9f97ce6aeeb01813a7063dac
SHA3-384 hash: a8743a748a349c699206efd4d86fc48d3b08540deb9b1f0bd012f946cbc3af3c710e166356764ed4433d531d11326e51
SHA1 hash: 8cc5b36af06094d62ba097a6caf4fe4fd9bedc84
MD5 hash: 09a8ee2dc3f0a88adde30a3c5f058616
humanhash: black-ack-magnesium-ink
File name:09a8ee2dc3f0a88adde30a3c5f058616
Download: download sample
Signature CoinMiner
Create hunting rule
File size:1'999'872 bytes
First seen:2021-09-20 19:14:12 UTC
Last seen:2021-09-20 21:47:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 49152:q+I4gabeFW/lGAspWSTnGFzrOmSP4tLUtYu6iBu/H:FbeWBNmEOg5U/6ig/H
Threatray 168 similar samples on MalwareBazaar
TLSH T18E953373B18D1852F7DEF33A02A924CA9B4FB951CCCD2C76C955C36267C98E8B258352
Reporter zbetcheckin
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
09a8ee2dc3f0a88adde30a3c5f058616
Verdict:
No threats detected
Analysis date:
2021-09-20 19:16:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/23bb20a6-8684-4fc5-bfef-2d57bb32b5c0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/189589/
Detection(s):
SecuriteInfo.com.Trojan.MulDropNET.46.16528.15693.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Launching a process
Creating a file in the %temp% directory
Creating a process with a hidden window
Creating a process from a recently created file
Creating a file in the system32 directory
Deleting a recently created file
Replacing files
Creating a file in the system32 subdirectories
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/aa20c5f0-c141-48d6-a615-91c941fdcc13
Result
Threat name:
BitCoin Miner
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/854404
Signature
Adds a directory exclusion to Windows Defender
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Script Execution From Temp Folder
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected BitCoin Miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 486837 Sample: 3hD6WyvaNg Startdate: 20/09/2021 Architecture: WINDOWS Score: 92 79 Multi AV Scanner detection for submitted file 2->79 81 Yara detected BitCoin Miner 2->81 83 Machine Learning detection for sample 2->83 85 2 other signatures 2->85 10 3hD6WyvaNg.exe 5 2->10         started        14 services32.exe 3 2->14         started        process3 file4 75 C:\Users\user\AppData\...\3hD6WyvaNg.exe.log, ASCII 10->75 dropped 99 Adds a directory exclusion to Windows Defender 10->99 16 cmd.exe 1 10->16         started        18 cmd.exe 1 10->18         started        77 C:\Users\user\AppData\Local\...\svchost32.exe, PE32+ 14->77 dropped 101 Multi AV Scanner detection for dropped file 14->101 103 Machine Learning detection for dropped file 14->103 21 cmd.exe 14->21         started        23 cmd.exe 14->23         started        signatures5 process6 signatures7 25 svchost32.exe 6 16->25         started        29 conhost.exe 16->29         started        87 Uses schtasks.exe or at.exe to add and modify task schedules 18->87 89 Adds a directory exclusion to Windows Defender 18->89 31 powershell.exe 23 18->31         started        33 powershell.exe 22 18->33         started        35 conhost.exe 18->35         started        41 2 other processes 18->41 37 conhost.exe 21->37         started        43 4 other processes 21->43 39 conhost.exe 23->39         started        process8 file9 71 C:\Windows\System32\services32.exe, PE32+ 25->71 dropped 73 C:\Windows\...\services32.exe:Zone.Identifier, ASCII 25->73 dropped 93 Multi AV Scanner detection for dropped file 25->93 95 Machine Learning detection for dropped file 25->95 97 Drops executables to the windows directory (C:\Windows) and starts them 25->97 45 services32.exe 25->45         started        48 cmd.exe 1 25->48         started        50 cmd.exe 25->50         started        signatures10 process11 signatures12 105 Adds a directory exclusion to Windows Defender 45->105 52 cmd.exe 45->52         started        55 conhost.exe 48->55         started        57 schtasks.exe 1 48->57         started        59 conhost.exe 50->59         started        61 choice.exe 50->61         started        process13 signatures14 91 Adds a directory exclusion to Windows Defender 52->91 63 conhost.exe 52->63         started        65 powershell.exe 52->65         started        67 powershell.exe 52->67         started        69 2 other processes 52->69 process15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b0bb8d472e211ec652e3a2658a2deb3a42cb5aff9f97ce6aeeb01813a7063dac/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-16 07:23:20 UTC
AV detection:
32 of 45 (71.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wc5y2rzoeepmmuxdujsyulplhjbmwwx7t6l442xowambhjyghwwa._file
Verdict:
malicious
Similar samples:
1b4d9981e15438e889193b4272e5bc6d07d0b8984e95741eb36f7cad3dec66e6
CoinMiner
3e4c7ea14c7244983b41edf75a23f40800771f02c0aba8afc0f087d6eee25d40
CoinMiner
4569c2ca16175dd869475526af97004f47e2918edb583043b609fceb86b35161
CoinMiner
493bfdb9e04607e49f6ead719b51e9c25cc8c4fa76bcb79c2f8e9225bb46e659
CoinMiner
73c1188d93bd4318a830cb6d891aae7580a61c396ce37ba3676a321bbd3a137e
CoinMiner
d99ac72301d4d4c55ee0c6e33ad4e4551bac90b71f80515eea1a3dfe426abf23
CoinMiner
f2dc381b529cbc75c03ca8bf1886b0ee6b1e2622f8918a27a876c50889e2ae7e
CoinMiner
f7873cf1b6200ab714ca6d6ff929fc4192d91a1cfc6d685cc734d8f1decb691d
CoinMiner
+ 158 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210920-xx9d8ahgfm/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
b0bb8d472e211ec652e3a2658a2deb3a42cb5aff9f97ce6aeeb01813a7063dac
MD5 hash:
09a8ee2dc3f0a88adde30a3c5f058616
SHA1 hash:
8cc5b36af06094d62ba097a6caf4fe4fd9bedc84
Link:
https://www.unpac.me/results/04c7cfde-5156-4da5-acf5-401566055440/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b0bb8d472e211ec652e3a2658a2deb3a42cb5aff9f97ce6aeeb01813a7063dac

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe b0bb8d472e211ec652e3a2658a2deb3a42cb5aff9f97ce6aeeb01813a7063dac

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/189589/
  
URLhaus
https://urlhaus.abuse.ch/url/1636481/

Comments


Avatar
zbet commented on 2021-09-20 19:14:14 UTC

url : hxxp://f0580154.xsph.ru/uzbek.exe