MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d70d5d5f3a5b2b4f8ac4b0ac51da334f5e4a669f82cb02044ed47a07d062f06a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d70d5d5f3a5b2b4f8ac4b0ac51da334f5e4a669f82cb02044ed47a07d062f06a
SHA3-384 hash: f93892b886b65ff39040a0a1d28f96bf6ee11324d87790cf4a8e94242a932a0c407a2dd929feae2c7cb4470f364c0860
SHA1 hash: 7f7ad71f05a85dd17a0f73d4499d4958d99f9c45
MD5 hash: 5e2203a832e887aac79ad17492d9dc88
humanhash: texas-orange-ohio-south
File name:d70d5d5f3a5b2b4f8ac4b0ac51da334f5e4a669f82cb02044ed47a07d062f06a
Download: download sample
File size:5'954'465 bytes
First seen:2020-11-10 08:47:21 UTC
Last seen:2024-07-24 21:56:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 71f37f91c14c4729e462a32b6b2ae9d4 (27 x CoinMiner, 12 x CobaltStrike)
ssdeep 98304:P16EaJgydfE0pZH756utgpPFotBER/mQ32lUn:NsJn56utgpPF8u/7n
Threatray 178 similar samples on MalwareBazaar
TLSH D9565D41EDAB01F2EB8711308CB74E5F633372190335EAC3DA650A6FE9276E56A36741
Reporter seifreed

Intelligence

File Origin
# of uploads :
2
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.CobaltStrike-8091534-0
Create hunting rule

Win.Tool.CobaltStrike-6336852-0
Create hunting rule

Win.Coinminer.Generic-7151250-0
Create hunting rule

Win.Coinminer.Generic-7151253-0
Create hunting rule

Win.Coinminer.Generic-7151447-0
Create hunting rule

Win.Coinminer.Generic-7151488-0
Create hunting rule

Win.Coinminer.Generic-7155777-0
Create hunting rule

Win.Coinminer.Generic-7158858-0
Create hunting rule

Win.Trojan.Razy-7331645-0
Create hunting rule

Win.Trojan.Razy-7332867-0
Create hunting rule

Multios.Coinminer.Miner-6781728-2
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d70d5d5f3a5b2b4f8ac4b0ac51da334f5e4a669f82cb02044ed47a07d062f06a/
Threat name:
Win64.Trojan.CoinMiner
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 08:49:16 UTC
AV detection:
38 of 48 (79.17%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
033b21c0aac19cb2813b4aaa0e4662135d3a2b80ac47c90349c6fcaaf9022a65
0f5a41631de5639ef01a6b3e2d77c63fddbaae40f19c5c0c2bcb8963581c396a
1fe5a9d860602bdc2ec975126ca6c46b42fded7c9e11191c0e9e1e5302dc66ae
4714055f6709ab573540b01860b10cd9d4aed171453be3e2955e9df13ef9aa7a
5cd01e7e4122c2ddee7b01bdd5a2e5a8ddb914e340cb5c096f55bdcb7207f287
7b226af4dfdd06463b9d7e5b0c09fb8a8ec0bed95114933b5c0a8828dd75cc14
a861087f4fbdbcaad53dc3eabafb1d82bfc2cf46e27730fbbef38c2747d809a1
c895226677ac96c6a83ae01702a6569064f9f02b7774169b6480792b23daadcd
f8cd3f7cf2cce0b04ec0506c6c4d1713b691b5ac34ad57c933474cfef3c99e63
f9d8cb5b89400ef9ac1592991157c7dec1f3c6be9a5fa056f0f78debefa48abd
+ 168 additional samples on MalwareBazaar
Result
Malware family:
cobaltstrike
Create hunting rule
Score:
  10/10
Tags:
family:cobaltstrike
Link:
https://tria.ge/reports/201110-3r1gnxxx62/
Malware Config
C2 Extraction:
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments