MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c32c371a2c98f101953ef8ef358c050908a05b1f0e228259d4115931ee21d8b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 8


Intelligence 8 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c32c371a2c98f101953ef8ef358c050908a05b1f0e228259d4115931ee21d8b1
SHA3-384 hash: 9689fa5ed8e5591c9d7e6a4aa23e027044323907038b8c040f8e22719322c83ced52c21f5fe717fc29765c84bb184002
SHA1 hash: 07d252f05db2c3fa283ece1a4950cb755a966e1c
MD5 hash: afaaf5c3f2768dfac82003a6ac8b8294
humanhash: massachusetts-arkansas-bulldog-asparagus
File name:file
Download: download sample
Signature CoinMiner
Create hunting rule
File size:5'383'392 bytes
First seen:2023-10-09 01:53:41 UTC
Last seen:2023-10-10 00:05:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash cbdefe4be79748f42666961c02169994 (1 x CoinMiner)
ssdeep 49152:YVj+qFyf7DknKiUEhMp/g0e6ttsV9XvcFHFge9Qxrw1uJbgA79tr5vQ0ZGEYoav6:JiPT+LlP1Q1dUw887
Threatray 1 similar samples on MalwareBazaar
TLSH T159461920D39186E5D2A7C070CDDA8FF865E2746B81365E0E0584DD2A2DFDF60EF9E1A1
TrID 51.7% (.EXE) InstallShield setup (43053/19/16)
19.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.6% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.4% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter andretavare5
Tags:CoinMiner exe signed

Code Signing Certificate

Organisation:Microsoft Code Signing PCA 2011
Issuer:Microsoft Code Signing PCA 2011
Algorithm:sha256WithRSAEncryption
Valid from:2023-10-09T00:42:59Z
Valid to:2024-10-09T00:42:59Z
Serial number: e1e86a1618245e6ab35d2c54c51305fa
Thumbprint Algorithm:SHA256
Thumbprint: 0ef669ceab9c96eb5847b40136dfa7f8cf8d1b0bf27c77959ae0d5ac17a35d00
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from http://185.225.74.144/files/Umm2.exe

Intelligence

File Origin
# of uploads :
33
# of downloads :
363
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win64.Malware-gen.21621.3899.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Connecting to a non-recommended domain
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Creating a window
Creating a file in the %AppData% subdirectories
Searching for synchronization primitives
Using the Windows Management Instrumentation requests
Launching cmd.exe command interpreter
Delayed reading of the file
Moving a file to the %AppData% subdirectory
Running batch commands
Blocking the User Account Control
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a recently created process
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Gathering data
Gathering data
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/c32c371a2c98f101953ef8ef358c050908a05b1f0e228259d4115931ee21d8b1
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9b210392-680e-406b-9786-6d8712930638
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c32c371a2c98f101953ef8ef358c050908a05b1f0e228259d4115931ee21d8b1/
Threat name:
Win64.Trojan.Privateloader
Create hunting rule
Status:
Suspicious
First seen:
2023-10-09 01:54:07 UTC
File Type:
PE+ (Exe)
AV detection:
12 of 22 (54.55%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ymwdogrmtdyqdfj67dxtldafbeekawy7byriewoucfmtd3rb3cyq._file
Verdict:
unknown
Similar samples:
2b5c4e2940a2db4ad0d2e8930036818c60c63a7b5453e7560f61cb693d97d941
CoinMiner
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:glupteba family:xmrig dropper evasion loader miner trojan upx
Link:
https://tria.ge/reports/231009-cbjw8ahd6z/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Launches sc.exe
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Drops startup file
Executes dropped EXE
Loads dropped DLL
UPX packed file
Downloads MZ/PE file
Modifies Windows Firewall
Possible attempt to disable PatchGuard
Stops running service(s)
Modifies boot configuration data using bcdedit
XMRig Miner payload
Amadey
Glupteba
Glupteba payload
UAC bypass
xmrig
Malware Config
C2 Extraction:
http://193.42.32.29/9bDc8sQ/index.php
Unpacked files
SH256 hash:
c32c371a2c98f101953ef8ef358c050908a05b1f0e228259d4115931ee21d8b1
MD5 hash:
afaaf5c3f2768dfac82003a6ac8b8294
SHA1 hash:
07d252f05db2c3fa283ece1a4950cb755a966e1c
Link:
https://www.unpac.me/results/21eb762d-f4e7-45c7-a578-95eacd6b6d7b/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c32c371a2c98/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2715393/

Comments