MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfb5c20ec8d95c35f7edb8743084d4491e43c62c575cf0102b4f6781c50689de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfb5c20ec8d95c35f7edb8743084d4491e43c62c575cf0102b4f6781c50689de
SHA3-384 hash: ef22c9adf3515a7439fc8ba7ea93b45217404d78d57d57acd6ba76fce0d4d83757a54424b8b0ed5f1cb49f5998eaf804
SHA1 hash: 30d26416cd5eef5ef56d9790aacc1272c7fba9ab
MD5 hash: 2fa10132cfbce32a5ac7ee72c3587e8b
humanhash: solar-zulu-helium-black
File name:2fa10132cfbce32a5ac7ee72c3587e8b.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:436'224 bytes
First seen:2023-07-07 05:15:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcfbb183dda4a3825a0923650518721c (1 x PrivateLoader, 1 x CoinMiner)
ssdeep 12288:xvXtnFWEutqcMgPoxntMRWru3Yo6T9XP+b9:99TgPoxntMQru3YLRWb9
TLSH T1B1946B04F2C088B2EC664435486BD971A63BFC350570DA2F2359B66E6F773D2682BF16
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 74ecccd8d0d4dcd4 (1 x RedLineStealer, 1 x PrivateLoader, 1 x CoinMiner)
Reporter abuse_ch
Tags:CoinMiner exe


Avatar
abuse_ch
CoinMiner C2:
http://77.91.68.3/home/love/index.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
333
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
setup_x86_x64_install.exe
Verdict:
Malicious activity
Analysis date:
2021-09-26 09:28:35 UTC
Tags:
trojan loader evasion rat redline stealer vidar
Link:
https://app.any.run/tasks/745a2b83-5c24-444a-8474-caf154fc36b7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/410243/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37620124.14924.991.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
DNS request
Query of malicious DNS domain
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/96084/overview
Behaviour
MalwareBazaar
CallSleep
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control greyware lolbin
Link:
https://www.filescan.io/uploads/64a79f9389e309292a8af565/reports/a87becd1-1a25-4844-ac95-e58abc484962/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/cfb5c20ec8d95c35f7edb8743084d4491e43c62c575cf0102b4f6781c50689de
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3150b4f3-9ebe-4844-bb78-af91da8632d0
Result
Threat name:
Amadey, Djvu, Fabookie, PrivateLoader, R
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1268863
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Detected VMProtect packer
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender (deletes autostart)
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies Group Policy settings
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (file name check)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected Amadeys stealer DLL
Yara detected Djvu Ransomware
Yara detected Fabookie
Yara detected PrivateLoader
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1268863 Sample: v774sM4fTi.exe Startdate: 07/07/2023 Architecture: WINDOWS Score: 100 180 Multi AV Scanner detection for domain / URL 2->180 182 Found malware configuration 2->182 184 Malicious sample detected (through community Yara rule) 2->184 186 25 other signatures 2->186 11 v774sM4fTi.exe 5 65 2->11         started        16 eqyvbous.exe 2->16         started        18 begjjrd 2->18         started        20 3 other processes 2->20 process3 dnsIp4 156 188.114.97.7 CLOUDFLARENETUS European Union 11->156 158 87.240.132.67 VKONTAKTE-SPB-AShttpvkcomRU Russian Federation 11->158 160 19 other IPs or domains 11->160 126 C:\Users\...\yPlBYIVBnzddob1SpTWOZ0_c.exe, PE32 11->126 dropped 128 C:\Users\...\xZlrLRymca5qVOgg02EAyXHB.exe, PE32 11->128 dropped 130 C:\Users\...\xY7bFDc56IEeh1MXryXq2nAe.exe, PE32+ 11->130 dropped 132 13 other files (12 malicious) 11->132 dropped 222 Detected unpacking (creates a PE file in dynamic memory) 11->222 224 Creates HTML files with .exe extension (expired dropper behavior) 11->224 226 Disable Windows Defender real time protection (registry) 11->226 22 KvpIyDR3wqqiMTYklMfRxqin.exe 11->22         started        25 QN7Tc1MBgw_QXupz4BiDKlPT.exe 11->25         started        28 GlwbFTDUFT6JPEBXpNnipJfX.exe 10 22 11->28         started        37 6 other processes 11->37 228 Detected unpacking (changes PE section rights) 16->228 230 Detected unpacking (overwrites its own PE header) 16->230 232 Writes to foreign memory regions 16->232 240 2 other signatures 16->240 31 svchost.exe 16->31         started        234 Multi AV Scanner detection for dropped file 18->234 236 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 18->236 238 Maps a DLL or memory area into another process 18->238 242 2 other signatures 18->242 33 WerFault.exe 20->33         started        35 WerFault.exe 20->35         started        file5 signatures6 process7 dnsIp8 188 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 22->188 190 Maps a DLL or memory area into another process 22->190 192 Checks if the current machine is a virtual machine (disk enumeration) 22->192 194 Creates a thread in another existing process (thread injection) 22->194 39 explorer.exe 22->39 injected 114 C:\Users\user\AppData\Local\...\v6986985.exe, PE32 25->114 dropped 116 C:\Users\user\AppData\Local\...\e9323653.exe, PE32 25->116 dropped 44 v6986985.exe 25->44         started        46 conhost.exe 25->46         started        172 2 other IPs or domains 28->172 118 C:\Windows\System32behaviorgraphroupPolicybehaviorgraphPT.INI, ASCII 28->118 dropped 196 Disables Windows Defender (deletes autostart) 28->196 198 Tries to harvest and steal browser information (history, passwords, etc) 28->198 200 Modifies Group Policy settings 28->200 202 Disable Windows Defender real time protection (registry) 28->202 48 chrome.exe 28->48         started        162 104.47.53.36 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 31->162 164 20.112.250.133 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 31->164 166 193.106.175.148 IQHOSTRU Russian Federation 31->166 204 System process connects to network (likely due to code injection or exploit) 31->204 168 146.59.161.7 OVHFR Norway 37->168 170 149.154.167.99 TELEGRAMRU United Kingdom 37->170 174 5 other IPs or domains 37->174 120 C:\Users\user\AppData\Local\Temp\fVl4uI.bxf, PE32 37->120 dropped 122 C:\Users\user\AppData\Local\...\eqyvbous.exe, PE32 37->122 dropped 124 C:\Users\...\3114a8217f6920c760f07292601e0871, SQLite 37->124 dropped 206 Tries to steal Crypto Currency Wallets 37->206 50 regsvr32.exe 37->50         started        52 cmd.exe 37->52         started        54 chrome.exe 37->54         started        56 5 other processes 37->56 file9 signatures10 process11 dnsIp12 144 103.233.24.19 WEBWERKS-AS-INWebWerksIndiaPvtLtdIN India 39->144 146 79.137.205.112 PSKSET-ASRU Russian Federation 39->146 152 4 other IPs or domains 39->152 100 C:\Users\user\AppData\Roaming\begjjrd, PE32 39->100 dropped 102 C:\Users\user\AppData\Local\Temp\FE0B.exe, PE32 39->102 dropped 104 C:\Users\user\AppData\Local\TempF0B.exe, PE32 39->104 dropped 112 15 other malicious files 39->112 dropped 212 System process connects to network (likely due to code injection or exploit) 39->212 214 Benign windows process drops PE files 39->214 216 Hides that the sample has been downloaded from the Internet (zone.identifier) 39->216 58 5155.exe 39->58         started        61 BD4A.exe 39->61         started        75 5 other processes 39->75 106 C:\Users\user\AppData\Local\...\v8083133.exe, PE32 44->106 dropped 108 C:\Users\user\AppData\Local\...\d9564475.exe, PE32 44->108 dropped 63 v8083133.exe 44->63         started        66 chrome.exe 48->66         started        218 Tries to detect sandboxes / dynamic malware analysis system (file name check) 50->218 110 C:\Windows\SysWOW64\...\eqyvbous.exe (copy), PE32 52->110 dropped 69 conhost.exe 52->69         started        148 172.217.168.10 GOOGLEUS United States 54->148 150 172.217.168.33 GOOGLEUS United States 54->150 154 7 other IPs or domains 54->154 71 conhost.exe 56->71         started        73 conhost.exe 56->73         started        77 3 other processes 56->77 file13 signatures14 process15 dnsIp16 220 Injects a PE file into a foreign processes 58->220 79 5155.exe 58->79         started        83 WerFault.exe 61->83         started        134 C:\Users\user\AppData\Local\...\v4677547.exe, PE32 63->134 dropped 136 C:\Users\user\AppData\Local\...\c2616964.exe, PE32 63->136 dropped 85 v4677547.exe 63->85         started        138 172.217.168.42 GOOGLEUS United States 66->138 140 104.17.24.14 CLOUDFLARENETUS United States 66->140 142 2 other IPs or domains 66->142 file17 signatures18 process19 dnsIp20 176 162.0.217.254 ACPCA Canada 79->176 94 C:\Users\user\AppData\Local\...\5155.exe, PE32 79->94 dropped 178 20.189.173.21 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 83->178 96 C:\Users\user\AppData\Local\...\b8240736.exe, PE32 85->96 dropped 98 C:\Users\user\AppData\Local\...\a4953206.exe, PE32 85->98 dropped 87 a4953206.exe 85->87         started        90 b8240736.exe 85->90         started        file21 process22 signatures23 208 Disable Windows Defender notifications (registry) 87->208 92 conhost.exe 87->92         started        210 Multi AV Scanner detection for dropped file 90->210 process24
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cfb5c20ec8d95c35f7edb8743084d4491e43c62c575cf0102b4f6781c50689de/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2021-09-22 03:02:54 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z624edwi3fodl57nxb2dbbgujepehrrmk5opaeblj5tydrigrhpa._file
Verdict:
malicious
Result
Malware family:
privateloader
Create hunting rule
Score:
  10/10
Tags:
family:privateloader evasion loader main spyware stealer trojan
Link:
https://tria.ge/reports/230707-fx5btsgd6s/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
Modifies Windows Defender Real-time Protection settings
PrivateLoader
Malware Config
C2 Extraction:
http://45.133.1.182/proxies.txt
http://45.133.1.107/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
51.178.186.149
http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
Unpacked files
SH256 hash:
cfb5c20ec8d95c35f7edb8743084d4491e43c62c575cf0102b4f6781c50689de
MD5 hash:
2fa10132cfbce32a5ac7ee72c3587e8b
SHA1 hash:
30d26416cd5eef5ef56d9790aacc1272c7fba9ab
Detections:
PrivateLoader
Create hunting rule
win_privateloader_w0
Create hunting rule
Link:
https://www.unpac.me/results/2c8a4482-399c-49d8-9e6b-7ce6a64b14c9/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cfb5c20ec8d9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cfb5c20ec8d95c35f7edb8743084d4491e43c62c575cf0102b4f6781c50689de

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:privateloader
Create hunting rule
Author:andretavare5
Description:PrivateLoader pay-per-install malware
Rule name:win_privateloader
Create hunting rule
Author:andretavare5
Reference:https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service
Rule name:win_privateloader_w0
Create hunting rule
Author:andretavare5
Reference:https://tavares.re/blog/2022/06/06/hunting-privateloader-pay-per-install-service

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/410243/

Comments