🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2c3e81aa24b20ac71147340adc1eaedf077ad00e4a2359e3db47b166cf5411a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e2c3e81aa24b20ac71147340adc1eaedf077ad00e4a2359e3db47b166cf5411a
SHA3-384 hash: 409a7849f1e138bd0df4de211aaf6283e88d30c49f4bfbeb510bf5dc7ee2474025b03e1de361c556291b889c332fb184
SHA1 hash: 38be55f1fc4ce1cb5438236abc5077019e5e1cdf
MD5 hash: 915aec68a5b53aa7681a461a122594d9
humanhash: queen-eleven-sink-chicken
File name:SecuriteInfo.com.Application.Generic.3320341.16084.10028
Download: download sample
Signature CoinMiner
Create hunting rule
File size:2'365'664 bytes
First seen:2023-01-12 09:30:33 UTC
Last seen:2023-10-02 07:19:04 UTC
File type: elf
MIME type:application/x-sharedlib
ssdeep 49152:88pDXL5ZA+E/VVZJboS3h7n5F1yoD61XPvfnIRIb:88N7vR+VVZVzJ5h+6A
TLSH T158B533E6459F2DAEF5D13BBF262561BBA48874BA59C8FF0441DED08FC03E5EA0305264
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter SecuriteInfoCom
Tags:8220 Gang CoinMiner elf

Intelligence

File Origin
# of uploads :
2
# of downloads :
170
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Application.Generic.3320341.16084.10028.UNOFFICIAL
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/63bfd35976cf1dd374b65385/reports/72e668be-0bd7-40f1-bf6d-5fb4e5b50d02/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
true
Architecture:
x86
Packer:
UPX
Botnet:
unknown
Number of open files:
213
Number of processes launched:
81
Processes remaning?
true
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/e2c3e81aa24b20ac71147340adc1eaedf077ad00e4a2359e3db47b166cf5411a
Behaviour
Anti-VM
Persistence
Process Renaming
Botnet C2s
TCP botnet C2(s):
167.114.114.169:8080
UDP botnet C2(s):
not identified
Malware family:
XMRig Miner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3f4d3780-b6f9-4e34-b3b3-9fe745f3d0f1
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad.mine
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1150190
Signature
Detected Stratum mining protocol
Executes the "crontab" command typically for achieving persistence
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using cron
Searches for CPU information (likely indicative for DDoS capability)
Snort IDS alert for network traffic
Tries to load the MSR kernel module used for reading/writing to CPUs model specific register
Writes to CPU model specific registers (MSR) (e.g. miners improve performance by disabling HW prefetcher)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 782921 Sample: SecuriteInfo.com.Applicatio... Startdate: 12/01/2023 Architecture: LINUX Score: 96 85 167.114.114.169, 51792, 8080 OVHFR Canada 2->85 87 109.202.202.202, 80 INIT7CH Switzerland 2->87 89 3 other IPs or domains 2->89 93 Snort IDS alert for network traffic 2->93 95 Malicious sample detected (through community Yara rule) 2->95 97 Multi AV Scanner detection for submitted file 2->97 99 Sample is packed with UPX 2->99 10 SecuriteInfo.com.Application.Generic.3320341.16084.10028.elf 2->10         started        signatures3 101 Detected Stratum mining protocol 85->101 process4 signatures5 109 Sample reads /proc/mounts (often used for finding a writable filesystem) 10->109 13 SecuriteInfo.com.Application.Generic.3320341.16084.10028.elf sh 10->13         started        16 SecuriteInfo.com.Application.Generic.3320341.16084.10028.elf sh 10->16         started        18 SecuriteInfo.com.Application.Generic.3320341.16084.10028.elf 10->18         started        21 3 other processes 10->21 process6 file7 83 /tmp/.cron, ASCII 13->83 dropped 23 sh crontab 13->23         started        27 sh 13->27         started        29 sh crontab 13->29         started        37 5 other processes 13->37 31 sh 16->31         started        33 sh grep 16->33         started        39 4 other processes 16->39 91 Writes to CPU model specific registers (MSR) (e.g. miners improve performance by disabling HW prefetcher) 18->91 35 SecuriteInfo.com.Application.Generic.3320341.16084.10028.elf sh 18->35         started        41 17 other processes 21->41 signatures8 process9 file10 81 /var/spool/cron/crontabs/tmp.kLexvm, ASCII 23->81 dropped 103 Sample tries to persist itself using cron 23->103 105 Executes the "crontab" command typically for achieving persistence 23->105 43 sh crontab 27->43         started        54 5 other processes 27->54 46 sh 31->46         started        48 sh 31->48         started        50 sh 31->50         started        56 4 other processes 31->56 107 Searches for CPU information (likely indicative for DDoS capability) 33->107 52 sh modprobe 35->52         started        58 7 other processes 39->58 60 5 other processes 41->60 signatures11 process12 signatures13 111 Executes the "crontab" command typically for achieving persistence 43->111 62 sh grep 46->62         started        65 sh cut 46->65         started        67 sh sed 46->67         started        69 sh sed 46->69         started        71 sh awk 48->71         started        73 sh 48->73         started        77 2 other processes 50->77 113 Tries to load the MSR kernel module used for reading/writing to CPUs model specific register 52->113 79 8 other processes 56->79 75 sh hostname 58->75         started        process14 signatures15 115 Searches for CPU information (likely indicative for DDoS capability) 62->115
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e2c3e81aa24b20ac71147340adc1eaedf077ad00e4a2359e3db47b166cf5411a/
Threat name:
Linux.Coinminer.BitCoinMiner
Create hunting rule
Status:
Malicious
First seen:
2022-12-29 16:12:50 UTC
File Type:
ELF64 Little (SO)
AV detection:
15 of 26 (57.69%)
Threat level:
  4/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4lb6qgvcjmqky4iuonak3qpk5xyhplia4srdlhr5wr5rm3hviena._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
antivm linux
Link:
https://tria.ge/reports/230112-lg2tnaff42/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Reads CPU attributes
Modifies hosts file
Writes DNS configuration
Attempts to identify hypervisor via CPU configuration
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

elf e2c3e81aa24b20ac71147340adc1eaedf077ad00e4a2359e3db47b166cf5411a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2505208/
  
Delivery method
Distributed via web download

Comments