MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c
SHA3-384 hash:	3df2243e8b53df9e282ecb42b87fd299919ae3592ba2682ab8b9d04880e52943c0a5208b710fe9f87b3e2c5f57f35dc5
SHA1 hash:	1ca9759a324159f331e79ea6871ad62040521b41
MD5 hash:	fbbcf1e9501234d6661a0c9ae6dc01c9
humanhash:	artist-queen-lima-triple
File name:	IMG001.scr
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	3'552'168 bytes
First seen:	2023-05-21 19:14:45 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep	98304:M5VPnq1y5tQOM33ZNqCtBixHl54Oyjes1Ro6:2VPq1yLanrqTr43eON
TLSH	T1E8F533259387902DC0498230788B2B66D37ACC173D0A17225F4277ADFE375EB7E8E656
TrID	92.7% (.EXE) NSIS - Nullsoft Scriptable Install System (846567/2/133) 3.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 1.1% (.EXE) Win64 Executable (generic) (10523/12/4) 0.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 0.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	3eb276367a6274bc (4 x CoinMiner)
Reporter	ULTRAFRAUD
Tags:	CoinMiner exe Neshta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

326

Origin country :

LU

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

http://103.7.248.244:9800/router-firmware/info.zip

Verdict:

Malicious activity

Analysis date:

2022-12-23 14:32:59 UTC

Tags:

miner

Link:

https://app.any.run/tasks/030982f1-19da-4df6-bce4-520f3c634922

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

Win.Trojan.Coinminer-6622864-0

Alert

Create hunting rule

Win.Trojan.Generic-6629329-0

Alert

Create hunting rule

Win.Trojan.Agentwdcr-19

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Creating a process with a hidden window

Running batch commands

Launching a process

Creating a file

Creating a window

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun by creating a file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

coinminer lolbin overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/646a6db9d549e9b80432771a/reports/54460250-13b3-445d-b0e8-c9bae3f8da82/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer CoinMiner

Malware family:

CoinMiner

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3ae22d08-baab-4389-9ab1-35f6a4fd88ce

Joe Sandbox Xmrig

Result

Threat name:

Xmrig

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.troj.spyw.evad.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1238884

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2016-01-01 05:30:14 UTC

File Type:

PE (Exe)

Extracted files:

33

AV detection:

35 of 37 (94.59%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3gibwfvjhkwxbgkhkjbxtvlsu6t37drhihrhueiszfmxpvfg5kga._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

persistence

Link:

https://tria.ge/reports/230521-xx8gxsbh76/

Behaviour

Creates scheduled task(s)

Discovers systems in the same network

Enumerates system info in registry

NTFS ADS

Runs net.exe

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

NSIS installer

Enumerates physical storage devices

Drops file in Windows directory

Adds Run key to start application

Enumerates connected drives

Checks computer location settings

Drops startup file

Executes dropped EXE

Loads dropped DLL

UnpacMe

Unpacked files

SH256 hash:

d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c

MD5 hash:

fbbcf1e9501234d6661a0c9ae6dc01c9

SHA1 hash:

1ca9759a324159f331e79ea6871ad62040521b41

Link:

https://www.unpac.me/results/236d93d8-9f08-4fb2-b7cd-d2c3fa42f458/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d9901b16a93aad709947524379d572a7a7bf8e2741e27a1112c95977d4a6ea8c