MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce9676c8db6fac696d6db020b83b562906f876e12c440ee2f443921ed0cc7b42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce9676c8db6fac696d6db020b83b562906f876e12c440ee2f443921ed0cc7b42
SHA3-384 hash: 826c17233bc145c0c3f0fa37d6522fa4b05d5fbb3acca60aa62371bc5e9bf5076bc5101e6cee8c98bfd910ad4c817cc3
SHA1 hash: 3b1bbece238bbb8a7e0bd77289088e10a4104509
MD5 hash: 6625a31165b1d7d865834ce8f78bed2b
humanhash: nebraska-juliet-victor-california
File name:6625a31165b1d7d865834ce8f78bed2b
Download: download sample
Signature CoinMiner
Create hunting rule
File size:3'297'280 bytes
First seen:2022-01-04 00:32:33 UTC
Last seen:2022-01-04 02:40:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 45c3eee06bcd5ef7518bc946e1677c4e (8 x CoinMiner)
ssdeep 98304:A9sBt5MQ6Hf0o3IN87vKZp0f9VE9dfb8JXJA4vfe4:A9oZ6HWN8DKof9VSt54
Threatray 150 similar samples on MalwareBazaar
TLSH T1DFE52303B48F3BF8C5A3C0B39719E465971325104FFAD9984B2C8B29A1C76355BC76AE
Reporter zbetcheckin
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
250
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6625a31165b1d7d865834ce8f78bed2b
Verdict:
No threats detected
Analysis date:
2022-01-04 00:35:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1f593c3c-f1b1-4c9a-8f85-cd96b34251aa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/217197/
Detection(s):
SecuriteInfo.com.Win64.Packed.Enigma.BV.1360.30614.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Sending an HTTP GET request
DNS request
Sending a custom TCP request
Blocking the Windows Defender launch
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61d395c492bdc4b4077ca5ca/reports/c25aa159-68b5-42fb-b7a6-da6b7a136e69/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6be217c2-fbc1-470e-a45a-51d9210367f4
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/915051
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 547529 Sample: Wo8g7g7PbE Startdate: 04/01/2022 Architecture: WINDOWS Score: 100 37 Antivirus / Scanner detection for submitted sample 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected Xmrig cryptocurrency miner 2->41 43 3 other signatures 2->43 7 RegHost.exe 1 2->7         started        10 Wo8g7g7PbE.exe 1 2 2->10         started        process3 dnsIp4 45 Antivirus detection for dropped file 7->45 47 Multi AV Scanner detection for dropped file 7->47 49 Detected unpacking (changes PE section rights) 7->49 57 4 other signatures 7->57 14 bfsvc.exe 1 7->14         started        16 conhost.exe 7->16         started        35 185.137.234.33, 49747, 49757, 8080 SELECTELRU Russian Federation 10->35 31 C:\Users\user\AppData\Roaming\...\RegHost.exe, PE32+ 10->31 dropped 51 Detected unpacking (overwrites its own PE header) 10->51 53 Writes to foreign memory regions 10->53 55 Allocates memory in foreign processes 10->55 18 curl.exe 1 10->18         started        21 bfsvc.exe 1 10->21         started        23 conhost.exe 10->23         started        file5 signatures6 process7 dnsIp8 25 conhost.exe 14->25         started        33 api.telegram.org 149.154.167.220, 443, 49749 TELEGRAMRU United Kingdom 18->33 27 conhost.exe 18->27         started        29 conhost.exe 21->29         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce9676c8db6fac696d6db020b83b562906f876e12c440ee2f443921ed0cc7b42/
Threat name:
Win64.Trojan.Enigma
Create hunting rule
Status:
Malicious
First seen:
2022-01-04 00:33:16 UTC
File Type:
PE+ (Exe)
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
22b1bd5ff8d474bb70ad086e75dbba870aaeb52599d436b84ba35e9e612078b4
CoinMiner
24af6536df79d1e84d9a8cbfae9fff2746db52a91ccd1f8c9cb66475c28db643
CoinMiner
7275bed26859a0b971d38c61e71cf6a2176f1a0c6af9a8391f94ec8372ac1198
CoinMiner
b72ca6cd6e45b2d7f82111021bc01cfa1e67809a012b58fb03e518db14644ea5
CoinMiner
d0fc379c7df252a133c75a749c1d8906599db2e7fc3fba0c929abbca25e41579
CoinMiner
e56e40b828cafc16582377e3086fa8a9f892190d2e6fe5b2686039c65dfb7360
CoinMiner
f95825c13bfccaa3bffe49f65d584cd015ce109b265df7bc75ace85c72ce7435
CoinMiner
fd787521a78a8c0c855e2bf5bf162eef857802008ce95b4a37f5c29e6158e7e7
CoinMiner
+ 140 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan upx
Link:
https://tria.ge/reports/220104-av722sfeg4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
UPX packed file
Modifies Windows Defender Real-time Protection settings
Unpacked files
SH256 hash:
ce9676c8db6fac696d6db020b83b562906f876e12c440ee2f443921ed0cc7b42
MD5 hash:
6625a31165b1d7d865834ce8f78bed2b
SHA1 hash:
3b1bbece238bbb8a7e0bd77289088e10a4104509
Link:
https://www.unpac.me/results/6d33d35b-c5a9-4efd-9a8e-3cdd1c78c105/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ce9676c8db6f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ce9676c8db6fac696d6db020b83b562906f876e12c440ee2f443921ed0cc7b42

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defedner features
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:XOREngine_Misc_XOR_Func
Create hunting rule
Author:smiller cc @florian @wesley idea on implementation with yara's built in XOR function
Description:Use with care, https://twitter.com/cyb3rops/status/1237042104406355968

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe ce9676c8db6fac696d6db020b83b562906f876e12c440ee2f443921ed0cc7b42

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1947356/
Cape
Cape
https://www.capesandbox.com/analysis/217197/

Comments


Avatar
zbet commented on 2022-01-04 00:32:35 UTC

url : hxxp://data-host-coin-8.com/files/9586_1641214762_9598.exe