MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cdd12576c48c2123efbc19404d37cc9505c80d8378f37e793a4b0ecb02aa2361. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cdd12576c48c2123efbc19404d37cc9505c80d8378f37e793a4b0ecb02aa2361
SHA3-384 hash: 38f10c4ec74d97ade78aa4f49519727c01effc9686d6c9c6eed793d0c1b583a8321475b761290953d242760d99d702da
SHA1 hash: 5c910ecb57f7a1016ae972058e9b785e3b4e232b
MD5 hash: 6eaf4b2f67fa41762b5cfefc2ec67e79
humanhash: angel-cold-south-hot
File name:6eaf4b2f67fa41762b5cfefc2ec67e79.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:3'366'912 bytes
First seen:2022-03-15 14:03:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f41bd45d825b0e2e44373b89f24d3e52 (5 x CoinMiner, 1 x CoinMiner.XMRig)
ssdeep 98304:7tioJNgpGQoF7cc/KFq0bEoypkEdEQ/nCEG+nB:7Veg7LyFq0bK1dEQ/nCx+B
Threatray 162 similar samples on MalwareBazaar
TLSH T1BCF5F1AE21543368C42AC4389523B846F1F2751E07B497DF76D7FEC13B6B990E52AB02
Reporter abuse_ch
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
socelars
Create hunting rule
ID:
1
File name:
setup_x86_x64_install.exe
Verdict:
Malicious activity
Analysis date:
2022-03-15 07:25:26 UTC
Tags:
evasion trojan socelars stealer loader phishing rat redline vidar
Link:
https://app.any.run/tasks/beea5a40-2fa9-4497-9a12-abf45667e7df

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/250835/
Detection(s):
SecuriteInfo.com.Trojan.Siggen17.25681.23316.3540.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% subdirectories
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Searching for synchronization primitives
DNS request
Connecting to a cryptocurrency mining pool
Creating a service
Launching a service
Loading a system driver
Sending an HTTP GET request
Blocking the Windows Defender launch
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  0/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/9290/overview
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/62309cdfdfdfa8501ca42f9d/reports/f76d84fe-b290-43a2-b5d4-4894d9e6cd07/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4ab050c4-6ab4-4df5-805a-bff252840c0b
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/957490
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Blacklisted process start detected (Windows program)
Detected Stratum mining protocol
DNS related to crypt mining pools
Found strings related to Crypto-Mining
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Sigma detected: Notepad Making Network Connection
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 589972 Sample: OnM3rCFqPM.exe Startdate: 15/03/2022 Architecture: WINDOWS Score: 100 68 xmr-eu1.nanopool.org 2->68 70 easyproducts.org 2->70 80 Antivirus detection for URL or domain 2->80 82 Antivirus detection for dropped file 2->82 84 Multi AV Scanner detection for dropped file 2->84 86 7 other signatures 2->86 9 OnM3rCFqPM.exe 1 5 2->9         started        14 RegHost.exe 1 1 2->14         started        signatures3 process4 dnsIp5 72 185.137.234.33, 49762, 49763, 8080 SELECTELRU Russian Federation 9->72 58 C:\Users\user\AppData\...\RegModule.exe, PE32+ 9->58 dropped 60 C:\Users\user\AppData\Roaming\...\RegHost.exe, PE32+ 9->60 dropped 62 C:\Users\user\AppData\Roaming\...\RegData.exe, PE32+ 9->62 dropped 64 C:\Users\user\AppData\...\OneDrive.exe, PE32+ 9->64 dropped 88 Hijacks the control flow in another process 9->88 90 Injects code into the Windows Explorer (explorer.exe) 9->90 92 Writes to foreign memory regions 9->92 94 Injects a PE file into a foreign processes 9->94 16 notepad.exe 1 9->16         started        20 explorer.exe 2 9->20         started        22 bfsvc.exe 1 9->22         started        24 conhost.exe 9->24         started        96 Multi AV Scanner detection for dropped file 14->96 98 Allocates memory in foreign processes 14->98 100 Modifies the context of a thread in another process (thread injection) 14->100 26 notepad.exe 1 14->26         started        28 explorer.exe 1 14->28         started        30 bfsvc.exe 1 14->30         started        32 conhost.exe 14->32         started        file6 signatures7 process8 dnsIp9 66 xmr-eu1.nanopool.org 51.15.78.68 OnlineSASFR France 16->66 74 System process connects to network (likely due to code injection or exploit) 16->74 76 Query firmware table information (likely to detect VMs) 16->76 78 Blacklisted process start detected (Windows program) 16->78 34 conhost.exe 16->34         started        36 curl.exe 1 20->36         started        38 curl.exe 1 20->38         started        40 curl.exe 1 20->40         started        50 2 other processes 20->50 42 conhost.exe 22->42         started        44 conhost.exe 26->44         started        46 conhost.exe 28->46         started        48 conhost.exe 30->48         started        signatures10 process11 process12 52 conhost.exe 36->52         started        54 conhost.exe 38->54         started        56 conhost.exe 40->56         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cdd12576c48c2123efbc19404d37cc9505c80d8378f37e793a4b0ecb02aa2361/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-03-15 17:52:00 UTC
AV detection:
15 of 27 (55.56%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
1430de888f5ef501e60e80398b0309a05f453a8b2e8c9b24fdaa5e722d2f8242
CoinMiner
1635567f96d69d53a64c49fb4a8cb5d65663d545f4ae4ea7c6465b49e4c297f4
CoinMiner
1fca453f1f9a6acf20ba5a9828178d70426e7f8e58ec6116f2aacf96053e0037
CoinMiner
206965feae3c8aa99bf38f625be1e674771faef044c013def41981e7af9bd403
CoinMiner
96b3aa4520797806ccaf670897eaead29ac9dd3f9a6add879e2d93f7e2557513
CoinMiner
e29526b1d3297a4d2d5cd5f8e4cce9a7a63b84f49470dafb02449269e055a4dc
CoinMiner
f963d6ed43903b4373d77c78e09e2fd0b8232290add918bbaf16cfa9ecb2f5c2
CoinMiner
+ 152 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan upx
Link:
https://tria.ge/reports/220315-rda5esaffl/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Downloads MZ/PE file
UPX packed file
Modifies Windows Defender Real-time Protection settings
Unpacked files
SH256 hash:
cdd12576c48c2123efbc19404d37cc9505c80d8378f37e793a4b0ecb02aa2361
MD5 hash:
6eaf4b2f67fa41762b5cfefc2ec67e79
SHA1 hash:
5c910ecb57f7a1016ae972058e9b785e3b4e232b
Link:
https://www.unpac.me/results/045e1760-73d6-4422-bdab-04bf8c5756d0/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/cdd12576c48c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.39
Link:
https://yomi.yoroi.company/submissions/cdd12576c48c2123efbc19404d37cc9505c80d8378f37e793a4b0ecb02aa2361

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/250835/

Comments