MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b581539d53ce4764849fe9d166fc268ed760b5652b0f9bb82cc5452629cd213f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b581539d53ce4764849fe9d166fc268ed760b5652b0f9bb82cc5452629cd213f
SHA3-384 hash: aefa30c52fd7dd85d07b5e6fe34850d166ff7c7bcf64c3c334dc1f0eec70ac446251c8cf58123f179b32f47f5ee98a1e
SHA1 hash: 8701280c630f5e82503f3918f329de1cd60038a3
MD5 hash: ad928236a82b4f7491d88be0dc26ccde
humanhash: fillet-bakerloo-hydrogen-kentucky
File name:b581539d53ce4764849fe9d166fc268ed760b5652b0f9bb82cc5452629cd213f
Download: download sample
File size:1'757'852 bytes
First seen:2020-11-07 22:29:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4290fa6afc89d56616f34ebbd0b1f2c (50 x CoinMiner)
ssdeep 49152:Lz071uv4BzMkibTIA5lCx7kvRWa4pxtUR:NABm
Threatray 114 similar samples on MalwareBazaar
TLSH AD8533464A1D1D3ECAAC213D78BD0F1B4491EF5184089DB8A3E7359B2F6CFAC1A4F54A
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Coinminer-7331384-0
Create hunting rule

Win.Trojan.Coinminer-7331970-0
Create hunting rule

Win.Trojan.Coinminer-7331971-0
Create hunting rule

Win.Trojan.Coinminer-7332650-0
Create hunting rule

Win.Trojan.Coinminer-7332688-0
Create hunting rule

Win.Trojan.Coinminer-7332725-0
Create hunting rule

Win.Trojan.Coinminer-7332745-0
Create hunting rule

Win.Trojan.Coinminer-9670639-0
Create hunting rule

Win.Trojan.Coinminer-9787657-0
Create hunting rule

Win.Trojan.Coinminer-9787666-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Launching a process
Creating a process from a recently created file
Connection attempt
Creating a window
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b581539d53ce4764849fe9d166fc268ed760b5652b0f9bb82cc5452629cd213f/
Threat name:
Win64.Trojan.CoinMiner
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 22:38:29 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0b66b1deec9b595f7fed1f044692eddf8b086de8ea1f49b44f3dd5cffc89c5d3
3917659714f9e7002c2ee4609034c29611fd9004722f7ded813b7677e2b23f40
5ec2a270a9b0e335fb6ecf9d313e02771acad023d7a1a6168a15297d1f80312d
65ded04b1d36d94598bb961bc8186f91894c515cb40c8f4f55b32704997da35d
7bb865328f85095be86faa5e85dec51187d0a594dc871b71f108c0dbe70a2d2d
7c90b8058b4d24a684a48b18978657af2e14fbbc11117193c2c244983b607be5
a170fe6e3f24d59751b8db1a95f124f9a58f410e20d7766dcf979d440334d1b7
c141c25789fb6d9ba283cf8b8657c97894132c998e91e2ff3dc79e9585addafe
e739b990bade805539447c5145fc87240912b28c73a50858edcc3b4f7c298bc7
f1d2a644341ea818f5decd36f6a627b2e9e94ae5e4a023de22dd6c20580a68ad
+ 104 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201108-155de8zl9a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Loads dropped DLL
Blacklisted process makes network request
Executes dropped EXE
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments