MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c06cafcfdd784450a09653e8d571c658c25adf34b7a7e9715cf28cbd4353d3b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c06cafcfdd784450a09653e8d571c658c25adf34b7a7e9715cf28cbd4353d3b8
SHA3-384 hash: 6f9b9cd0b69ef2f3fa9d6de2a18fcc957df961068b44476eec0543cd4c2cae09e0006e643e25fa95503b7d90f806020a
SHA1 hash: d1f57e41d9f211c4e6ccf5073bd43066c029cc19
MD5 hash: 1de92371d3d0739779a825ba464e6df1
humanhash: louisiana-quiet-xray-two
File name:c06cafcfdd784450a09653e8d571c658c25adf34b7a7e9715cf28cbd4353d3b8
Download: download sample
File size:1'843'366 bytes
First seen:2020-11-07 18:31:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e4290fa6afc89d56616f34ebbd0b1f2c (50 x CoinMiner)
ssdeep 49152:Lz071uv4BrMkibTIA5lCx7kvRWa4p1HzDgU7ybs:NABh
Threatray 107 similar samples on MalwareBazaar
TLSH 1D8523595E591C7ECAE8203C24BD0F0F81A1DF528148ED78E3E6355F2A6DBAD125F20A
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Coinminer-7331384-0
Create hunting rule

Win.Malware.Eati-7331635-0
Create hunting rule

Win.Trojan.Coinminer-7331970-0
Create hunting rule

Win.Trojan.Coinminer-7331971-0
Create hunting rule

Win.Trojan.Coinminer-7332650-0
Create hunting rule

Win.Trojan.Coinminer-7332688-0
Create hunting rule

Win.Trojan.Coinminer-7332689-0
Create hunting rule

Win.Trojan.Coinminer-7332725-0
Create hunting rule

Win.Trojan.Coinminer-7332745-0
Create hunting rule

Win.Trojan.Coinminer-9670639-0
Create hunting rule

Win.Trojan.Coinminer-9787657-0
Create hunting rule

Win.Trojan.Coinminer-9787666-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Launching a process
Creating a process from a recently created file
Connection attempt
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c06cafcfdd784450a09653e8d571c658c25adf34b7a7e9715cf28cbd4353d3b8/
Gathering data
Verdict:
malicious
Similar samples:
0b66b1deec9b595f7fed1f044692eddf8b086de8ea1f49b44f3dd5cffc89c5d3
65ded04b1d36d94598bb961bc8186f91894c515cb40c8f4f55b32704997da35d
7bb865328f85095be86faa5e85dec51187d0a594dc871b71f108c0dbe70a2d2d
89d5d36ce9e1a8119729880250f8a3ce47f878c0b1164a62e9ae5751ca0d8b36
b581539d53ce4764849fe9d166fc268ed760b5652b0f9bb82cc5452629cd213f
bf405687cd27cfe531be4b76ba191961ebaccc8edf694766921a98f246b30178
c141c25789fb6d9ba283cf8b8657c97894132c998e91e2ff3dc79e9585addafe
c74a0dc8a8bcd0ecab2b7bff864a0e628b60d5269146027fa8f2bd0f2a4d0d3c
e739b990bade805539447c5145fc87240912b28c73a50858edcc3b4f7c298bc7
f1d2a644341ea818f5decd36f6a627b2e9e94ae5e4a023de22dd6c20580a68ad
+ 97 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/201108-twzcfvb1ds/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Loads dropped DLL
Executes dropped EXE
UPX packed file
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments