MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d99ac72301d4d4c55ee0c6e33ad4e4551bac90b71f80515eea1a3dfe426abf23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d99ac72301d4d4c55ee0c6e33ad4e4551bac90b71f80515eea1a3dfe426abf23
SHA3-384 hash: 008318e880e5c7bcef1f8addd71e736c0bc58303a8b6b7eb20f3331b7cd40b92d77f03e474ce1f9a99a56ebb1ee57e74
SHA1 hash: 44ec1e95d1089db7f68ed1fba4c102fef03ad460
MD5 hash: 8f3e17070111838622cfb69ec4868fe7
humanhash: india-shade-ack-may
File name:8f3e17070111838622cfb69ec4868fe7
Download: download sample
Signature CoinMiner
Create hunting rule
File size:1'999'360 bytes
First seen:2021-08-28 21:05:42 UTC
Last seen:2021-08-28 22:04:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 49152:lMdX/2ZvQyUxBHUNupxvHk30hgB+B4WBN/rwUlHNUhRtl:+dXKI3pxvHk30hgE6Wb/llIv
Threatray 122 similar samples on MalwareBazaar
TLSH T1299533922AB50861DBFD1B7C1B5062034AA4C956B482FD0864DA16CADFEF49DF7C12F3
Reporter zbetcheckin
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8f3e17070111838622cfb69ec4868fe7
Verdict:
No threats detected
Analysis date:
2021-08-28 21:11:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d4282c2f-7a8d-450f-a203-568c837e93ae

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/183152/
Detection(s):
SecuriteInfo.com.Trojan.MulDropNET.46.31721.11360.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Launching a process
Using the Windows Management Instrumentation requests
Creating a file in the %temp% directory
Creating a process with a hidden window
Creating a file
Creating a process from a recently created file
Creating a file in the system32 directory
Sending a UDP request
Creating a file in the system32 subdirectories
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6ed4c3dc-5454-454b-82ef-fe0639fbd34b
Result
Threat name:
BitCoin Miner
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/840867
Signature
Adds a directory exclusion to Windows Defender
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Script Execution From Temp Folder
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected BitCoin Miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 473294 Sample: UjRIsYXXG3 Startdate: 28/08/2021 Architecture: WINDOWS Score: 92 81 Multi AV Scanner detection for submitted file 2->81 83 Yara detected BitCoin Miner 2->83 85 Machine Learning detection for sample 2->85 87 2 other signatures 2->87 10 UjRIsYXXG3.exe 5 2->10         started        14 services32.exe 2->14         started        process3 file4 77 C:\Users\user\AppData\...\UjRIsYXXG3.exe.log, ASCII 10->77 dropped 101 Adds a directory exclusion to Windows Defender 10->101 16 cmd.exe 1 10->16         started        18 cmd.exe 1 10->18         started        79 C:\Users\user\AppData\Local\...\svchost32.exe, PE32+ 14->79 dropped 21 cmd.exe 14->21         started        23 cmd.exe 14->23         started        signatures5 process6 signatures7 25 svchost32.exe 6 16->25         started        29 conhost.exe 16->29         started        89 Uses schtasks.exe or at.exe to add and modify task schedules 18->89 91 Adds a directory exclusion to Windows Defender 18->91 31 powershell.exe 23 18->31         started        33 powershell.exe 20 18->33         started        35 conhost.exe 18->35         started        41 2 other processes 18->41 37 conhost.exe 21->37         started        43 4 other processes 21->43 39 conhost.exe 23->39         started        process8 file9 73 C:\Windows\System32\services32.exe, PE32+ 25->73 dropped 75 C:\Windows\...\services32.exe:Zone.Identifier, ASCII 25->75 dropped 95 Multi AV Scanner detection for dropped file 25->95 97 Machine Learning detection for dropped file 25->97 99 Drops executables to the windows directory (C:\Windows) and starts them 25->99 45 services32.exe 25->45         started        48 cmd.exe 1 25->48         started        50 cmd.exe 25->50         started        52 conhost.exe 31->52         started        signatures10 process11 signatures12 103 Multi AV Scanner detection for dropped file 45->103 105 Machine Learning detection for dropped file 45->105 107 Adds a directory exclusion to Windows Defender 45->107 54 cmd.exe 45->54         started        57 conhost.exe 48->57         started        59 schtasks.exe 1 48->59         started        61 conhost.exe 50->61         started        63 choice.exe 50->63         started        process13 signatures14 93 Adds a directory exclusion to Windows Defender 54->93 65 conhost.exe 54->65         started        67 powershell.exe 54->67         started        69 powershell.exe 54->69         started        71 2 other processes 54->71 process15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d99ac72301d4d4c55ee0c6e33ad4e4551bac90b71f80515eea1a3dfe426abf23/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-28 09:41:02 UTC
AV detection:
16 of 25 (64.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3gnmoiyb2tkmkxxay3rtvvhekun2zefxd6afcxxkdi674qtkx4rq._file
Verdict:
unknown
Similar samples:
2dfdc495160b8492466dfe6108702ea44b5a7ff1b8d439d6a6dc9af9359a0838
CoinMiner
4569c2ca16175dd869475526af97004f47e2918edb583043b609fceb86b35161
CoinMiner
51bf9ff43b1aedfebfcf03c71e5bba10a6704b2cf4503e5bbe680221652cc458
CoinMiner
5d459a560ce1e32853c637997806cf8080c8d8f02d0c136057a0344d543b2532
CoinMiner
7b483b575f88d063ec7d84405be25d5d29579133e9951e5f7b5e2b0d9632472f
CoinMiner
a58198274fe278903f5cc16907437a6198725be5bc248d2b6155cd702caf3ed3
CoinMiner
eef5d903a7e1eb2b6ecd93316efad2bf00def8fd4466dae0157615726a46ba4b
CoinMiner
f2dc381b529cbc75c03ca8bf1886b0ee6b1e2622f8918a27a876c50889e2ae7e
CoinMiner
ff1ddb96f4984d4ed65016ca7814432d51a08fe090fae4907e85926469e880da
CoinMiner
+ 112 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210828-vrztqpklce/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
d99ac72301d4d4c55ee0c6e33ad4e4551bac90b71f80515eea1a3dfe426abf23
MD5 hash:
8f3e17070111838622cfb69ec4868fe7
SHA1 hash:
44ec1e95d1089db7f68ed1fba4c102fef03ad460
Link:
https://www.unpac.me/results/4e01fb2e-6f83-4cdf-b438-9afde7f60e68/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d99ac72301d4d4c55ee0c6e33ad4e4551bac90b71f80515eea1a3dfe426abf23

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe d99ac72301d4d4c55ee0c6e33ad4e4551bac90b71f80515eea1a3dfe426abf23

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1573261/
Cape
Cape
https://www.capesandbox.com/analysis/183152/

Comments


Avatar
zbet commented on 2021-08-28 21:05:44 UTC

url : hxxp://a0574956.xsph.ru/dag.exe