MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df0bc1a4eb32d964f7405e8238e28d4c67e33e8552c708247a4cd654a30b836d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df0bc1a4eb32d964f7405e8238e28d4c67e33e8552c708247a4cd654a30b836d
SHA3-384 hash: 1e988d73a7c2479ba3fe72c439c44e133fb8d6f744384faa290d43aa146809561d3f7794ddbbefd80bf5407e43657aaa
SHA1 hash: 3775fe043433150b5fcfc58417344bb5539e1bd0
MD5 hash: 6fb31a4c8e4dac75c5ce93f191439f5c
humanhash: stream-kentucky-massachusetts-west
File name:GoogleCrashHandler32.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:4'347'392 bytes
First seen:2021-05-17 13:26:40 UTC
Last seen:2021-05-17 13:52:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash dc12932426806b6b47a373d7ae42c21d (12 x CoinMiner, 1 x StealeriumStealer)
ssdeep 98304:MKxvicy6eCzbaThbLJyCx+9kzik3WkQ41Zc0Hui3:nlFzbohbLgCskukfQOZ1uG
Threatray 4 similar samples on MalwareBazaar
TLSH 15163315BA621AB7C45EC775FC9682483F79BDD143379E6C26827593CE2608938CF0CA
Reporter 0x746f6d6669
Tags:CoinMiner

Intelligence

File Origin
# of uploads :
2
# of downloads :
277
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
GoogleCrashHandler32.exe
Verdict:
No threats detected
Analysis date:
2021-05-17 14:03:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1531356d-bc1c-4384-951e-57a0c90b7b5a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/157872/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.9362.2198.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Launching a process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/783509
Signature
Changes security center settings (notifications, updates, antivirus, firewall)
Connects to a pastebin service (likely for C&C)
Detected unpacking (changes PE section rights)
Drops PE files to the user root directory
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 415904 Sample: GoogleCrashHandler32.exe Startdate: 17/05/2021 Architecture: WINDOWS Score: 100 57 Malicious sample detected (through community Yara rule) 2->57 59 Yara detected Xmrig cryptocurrency miner 2->59 61 Machine Learning detection for sample 2->61 63 4 other signatures 2->63 8 GoogleCrashHandler32.exe 8 2->8         started        12 svchost.exe 1 2->12         started        14 svchost.exe 2->14         started        16 8 other processes 2->16 process3 dnsIp4 45 C:\Users\userbehaviorgraphoogleCrashHandler32.exe, PE32+ 8->45 dropped 47 GoogleCrashHandler32.exe:Zone.Identifier, ASCII 8->47 dropped 49 C:\Users\...behaviorgraphoogleCrashHandler32.exe.log, ASCII 8->49 dropped 75 Detected unpacking (changes PE section rights) 8->75 77 Drops PE files to the user root directory 8->77 79 Sample is not signed and drops a device driver 8->79 81 Tries to detect virtualization through RDTSC time measurements 8->81 19 GoogleCrashHandler32.exe 3 8->19         started        23 cmd.exe 1 8->23         started        83 System process connects to network (likely due to code injection or exploit) 12->83 85 Tries to detect sandboxes and other dynamic analysis tools (window names) 12->85 87 Changes security center settings (notifications, updates, antivirus, firewall) 14->87 25 MpCmdRun.exe 1 14->25         started        51 127.0.0.1 unknown unknown 16->51 file5 signatures6 process7 file8 43 C:\Users\user\AppData\Roaming\...\WR64.sys, PE32+ 19->43 dropped 65 Multi AV Scanner detection for dropped file 19->65 67 Detected unpacking (changes PE section rights) 19->67 69 Tries to detect sandboxes and other dynamic analysis tools (window names) 19->69 73 5 other signatures 19->73 27 svchost.exe 19->27         started        31 cmd.exe 1 19->31         started        71 Uses schtasks.exe or at.exe to add and modify task schedules 23->71 33 conhost.exe 23->33         started        35 schtasks.exe 1 23->35         started        37 conhost.exe 25->37         started        signatures9 process10 dnsIp11 53 worldexpressdelivery.art 45.147.231.35, 49719, 5555 COMBAHTONcombahtonGmbHDE Germany 27->53 55 pastebin.com 104.23.99.190, 443, 49718 CLOUDFLARENETUS United States 27->55 89 Query firmware table information (likely to detect VMs) 27->89 39 conhost.exe 31->39         started        41 schtasks.exe 1 31->41         started        signatures12 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df0bc1a4eb32d964f7405e8238e28d4c67e33e8552c708247a4cd654a30b836d/
Threat name:
Win64.Trojan.Tasker
Create hunting rule
Status:
Malicious
First seen:
2021-05-17 13:27:57 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
29b10facf712978e41161daf15235a8d74ef5cf16318a5887e39ee1e8cff297b
CoinMiner
831ba6efa4a49eb1c7ff749fe442b393c5a614f383bf1efb52512a183b4362fc
CoinMiner
a2f0a1d469d73a11c69afc9eb12000fa7f7652305d936a10d12dabce693f878b
CoinMiner
f8915227c25c5ac552d66f3708f615cd517363953829d3715f38666d7dfa9770
CoinMiner
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig miner
Link:
https://tria.ge/reports/210517-e2s7dqfcaa/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Checks BIOS information in registry
Loads dropped DLL
Executes dropped EXE
XMRig Miner Payload
xmrig
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe df0bc1a4eb32d964f7405e8238e28d4c67e33e8552c708247a4cd654a30b836d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1247290/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/157872/

Comments