MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6110583978af41e0ec6705f89b4c6c0acccb6b314b6376052f1b984bd282456. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6110583978af41e0ec6705f89b4c6c0acccb6b314b6376052f1b984bd282456
SHA3-384 hash: e0ba149c3d5abfc5059f9a59b70ec6eb96845517145e29057b2a7a4659d30944224c1275e47c14de204b2e24c47586b3
SHA1 hash: 8c02f9ba286aa479a3d84cf8d2c523623f792730
MD5 hash: 256e66c0fef525db6cec42d72971d846
humanhash: oranges-tennis-mockingbird-lima
File name:256e66c0fef525db6cec42d72971d846
Download: download sample
Signature CoinMiner
Create hunting rule
File size:2'043'392 bytes
First seen:2021-11-11 02:35:38 UTC
Last seen:2021-11-11 05:24:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 02549ff92b49cce693542fc9afb10102 (84 x CoinMiner, 2 x CoinMiner.XMRig, 1 x AgentTesla)
ssdeep 49152:Sos/UbAdetYQrSuBlT5OX5Ti9wIyEL9ctVqIaw3Lvz2U+zJe:Sos8bAdwrzSJTiGIzmtvN3Lvizg
Threatray 206 similar samples on MalwareBazaar
TLSH T1C59533D20AC82B58D71E8B7A73B0A21F3E3F54D282586D1F04956F464C2B5773AC5B8E
Reporter zbetcheckin
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/204902/
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.23470.4054.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
donut packed
Link:
https://www.filescan.io/uploads/618c8194dec3347825a1acb8/reports/4f161115-d325-4c99-ab98-2537f39f3d0c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8a7b83a6-db8c-4543-970c-deb63516b834
Result
Threat name:
BitCoin Miner
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/887232
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected BitCoin Miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 519705 Sample: Z1WNOF2gno Startdate: 11/11/2021 Architecture: WINDOWS Score: 84 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected BitCoin Miner 2->50 9 Z1WNOF2gno.exe 2->9         started        12 services32.exe 2->12         started        process3 signatures4 64 Writes to foreign memory regions 9->64 66 Allocates memory in foreign processes 9->66 68 Creates a thread in another existing process (thread injection) 9->68 14 conhost.exe 5 9->14         started        70 Multi AV Scanner detection for dropped file 12->70 17 conhost.exe 5 12->17         started        process5 file6 40 C:\Windows\System32\services32.exe, PE32+ 14->40 dropped 42 C:\Windows\...\services32.exe:Zone.Identifier, ASCII 14->42 dropped 20 cmd.exe 1 14->20         started        23 cmd.exe 1 14->23         started        44 C:\Windows\System32\...\sihost32.exe, PE32+ 17->44 dropped 46 Drops executables to the windows directory (C:\Windows) and starts them 17->46 25 sihost32.exe 17->25         started        signatures7 process8 signatures9 52 Drops executables to the windows directory (C:\Windows) and starts them 20->52 27 services32.exe 20->27         started        30 conhost.exe 20->30         started        54 Uses schtasks.exe or at.exe to add and modify task schedules 23->54 32 conhost.exe 23->32         started        34 schtasks.exe 1 23->34         started        56 Multi AV Scanner detection for dropped file 25->56 58 Writes to foreign memory regions 25->58 60 Allocates memory in foreign processes 25->60 62 Creates a thread in another existing process (thread injection) 25->62 36 conhost.exe 2 25->36         started        process10 signatures11 72 Writes to foreign memory regions 27->72 74 Allocates memory in foreign processes 27->74 76 Creates a thread in another existing process (thread injection) 27->76 38 conhost.exe 2 27->38         started        process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c6110583978af41e0ec6705f89b4c6c0acccb6b314b6376052f1b984bd282456/
Threat name:
Win64.Trojan.Donut
Create hunting rule
Status:
Malicious
First seen:
2021-11-08 17:41:02 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
191018b2c61b46c04fba2acfd7138621ad327b5e918bee60e551c466aa9aca33
CoinMiner
28f5fb04e33ee8f3257b1a2c6f4ade3f281b0d474eea4bdde2abe622a1b11994
CoinMiner
58f64e4083fa288b091dc0d29a050da9cd09e4ee6607aff2e5fa5ffbe2c7a887
CoinMiner
94cbc6a1b4cc99bbfb3824eab5720009773c04a2b4e628789d7db4f824a78201
CoinMiner
979489468d527202ce55a465799013a16fccfcc838d523707a016e064a0e85a1
CoinMiner
d3971de408a80057671d1f39dd0aafcb4501903b6c9cf7f5fb51fffc0ab43599
CoinMiner
e3253959f7dac8718f377871ab2640f8f227563c8963d2c94ff4d4f571e00f13
CoinMiner
f70e0c1d6dcec7a1da46f9b0a76f717d8b8d33bc8e15898d0dce194bec87eedc
CoinMiner
f89908f8594a0dccfb5e52b295075ff63be86c0f5584f990d39dfe2b2c2f9c08
CoinMiner
f9194db6a27bfd9322186caf3fa8337f6b5197301798818920e84724362ee801
CoinMiner
+ 196 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/211111-c3kylaafb7/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
c6110583978af41e0ec6705f89b4c6c0acccb6b314b6376052f1b984bd282456
MD5 hash:
256e66c0fef525db6cec42d72971d846
SHA1 hash:
8c02f9ba286aa479a3d84cf8d2c523623f792730
Link:
https://www.unpac.me/results/71352e7a-a56c-4798-a231-bc35bca150e7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/c6110583978af41e0ec6705f89b4c6c0acccb6b314b6376052f1b984bd282456

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe c6110583978af41e0ec6705f89b4c6c0acccb6b314b6376052f1b984bd282456

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1775261/
Cape
Cape
https://www.capesandbox.com/analysis/204902/

Comments


Avatar
zbet commented on 2021-11-11 02:35:39 UTC

url : hxxp://antivirf.ru/kolop.exe