MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 be032b655d9a935fbca887adfc5e478085b7d64c96720c57da870c2d463ed881. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
CoinMiner
Vendor detections: 10
| SHA256 hash: | be032b655d9a935fbca887adfc5e478085b7d64c96720c57da870c2d463ed881 |
|---|---|
| SHA3-384 hash: | 2dbfee055a67fe168bcd45b07a179dfab3a03ac259011a2ca472920a641c644c718a735e5e03f230acea4632b4aa06cb |
| SHA1 hash: | 3266d2f320b9fa50051570da99e7ed62046e2203 |
| MD5 hash: | 4554b2e507e6c89c9a7d51097f2f155f |
| humanhash: | wisconsin-hawaii-blossom-high |
| File name: | 4554b2e507e6c89c9a7d51097f2f155f |
| Download: | download sample |
| Signature | CoinMiner |
| File size: | 340'480 bytes |
| First seen: | 2021-10-20 12:59:57 UTC |
| Last seen: | 2021-10-20 16:10:40 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 6a88739b00d2f75a49bbb4078e077ebf (1 x CoinMiner, 1 x Smoke Loader, 1 x RaccoonStealer) |
| ssdeep | 3072:NC7BSM9qPJ5nlqHBJR4RAHjxT0uRdDh/SQgnSpI/7C4YmIBPoeWUNSJ/Hf9ArjxE:NHUR/DiuFZudzCvvPSJ/HfmoIZ0AMz |
| Threatray | 5'067 similar samples on MalwareBazaar |
| TLSH | T126748C10AAA0C039F1F752F8597A93ACB93E7EA16B2590CF52D416EE47346E1EC31317 |
| File icon (PE): |  |
| dhash icon | aad8ac9cc6e68ee0 (12 x RedLineStealer, 6 x RaccoonStealer, 3 x Smoke Loader) |
| Reporter |  zbetcheckin |
| Tags: | 32 CoinMiner exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
280
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
greyware
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
Amadey RedLine SmokeLoader Tofsee Vidar
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
Changes security center settings (notifications, updates, antivirus, firewall)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Detected VMProtect packer
DLL reload attack detected
Drops executables to the windows directory (C:\Windows) and starts them
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Renames NTDLL to bypass HIPS
Sigma detected: Copying Sensitive Files with Credential Data
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Amadey bot
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Vidar
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Ransomware.StopCrypt
Status:
Malicious
First seen:
2021-10-20 13:00:07 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 5'057 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Score:
10/10
Tags:
family:amadey family:raccoon family:redline family:smokeloader family:tofsee family:vidar family:xmrig botnet:1029 botnet:706 botnet:7ebf9b416b72a203df65383eec899dc689d2c3d7 botnet:install backdoor discovery evasion infostealer miner persistence spyware stealer themida trojan vmprotect
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Modifies data under HKEY_USERS
Modifies Internet Explorer settings
Kills process with taskkill
Delays execution with timeout.exe
Creates scheduled task(s)
Checks processor information in registry
Checks SCSI registry key(s)
Program crash
Enumerates physical storage devices
Launches sc.exe
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops file in System32 directory
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Deletes itself
Checks BIOS information in registry
VMProtect packed file
Sets service image path in registry
Modifies Windows Firewall
Executes dropped EXE
Downloads MZ/PE file
Creates new service(s)
XMRig Miner Payload
Vidar Stealer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
xmrig
Windows security bypass
Vidar
Tofsee
Suspicious use of NtCreateProcessExOtherParentProcess
SmokeLoader
RedLine Payload
RedLine
Raccoon
Amadey
Malware Config
C2 Extraction:
http://gejajoo7.top/
http://sysaheu9.top/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/
quadoil.ru
lakeflex.ru
https://mas.to/@xeroxxx
176.9.244.86:23637
185.215.113.45/g4MbvE/index.php
http://sysaheu9.top/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/
quadoil.ru
lakeflex.ru
https://mas.to/@xeroxxx
176.9.244.86:23637
185.215.113.45/g4MbvE/index.php
Unpacked files
SH256 hash:
097906bdec7fecaf49605e0c5fb1386352f41def3e81499cb73c72628662426e
MD5 hash:
e227480c64c0fcf5ec29f2747c84d2b8
SHA1 hash:
28a8e6758353d14f9d3fd69a0057ee43b27661c2
SH256 hash:
be032b655d9a935fbca887adfc5e478085b7d64c96720c57da870c2d463ed881
MD5 hash:
4554b2e507e6c89c9a7d51097f2f155f
SHA1 hash:
3266d2f320b9fa50051570da99e7ed62046e2203
Malware family:
SmokeLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://privacytoolzforyou-5000.top/downloads/toolspab2.exe