MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e479db70018c1524ad4e7134186c418a043d815e13bf29b0b667a4928e6d8cde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e479db70018c1524ad4e7134186c418a043d815e13bf29b0b667a4928e6d8cde
SHA3-384 hash: 48a1936b99de9ed7d83af9800abc3ea8e6ce45adef6a6a256da77bb5f01d19a928bdf83404d7b5333b9f006f0cca66df
SHA1 hash: 6003c0f93c9d3d1e7f6540f65e87487215addb65
MD5 hash: 048f76b5840dc202d8d029645c60c5a7
humanhash: mike-bluebird-stairway-green
File name:lbvgkmtzwmke.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:2'643'456 bytes
First seen:2023-12-19 16:34:37 UTC
Last seen:2023-12-19 18:19:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash de41d4e0545d977de6ca665131bb479a (85 x CoinMiner)
ssdeep 49152:AsbIMmHki22H/aVv3UZLh8C4Tb+S6zh3+LJsT1HequYIP:As5kki22iV/m2H+9+LJs5+fYI
Threatray 20 similar samples on MalwareBazaar
TLSH T136C533AE57DAC175E966983BC4DC8F78235771B48F042AFB11936A14E1A1D8CC078F8B
TrID 49.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
31.8% (.EXE) Win64 Executable (generic) (10523/12/4)
6.1% (.EXE) OS/2 Executable (generic) (2029/13)
6.0% (.EXE) Generic Win/DOS Executable (2002/3)
6.0% (.EXE) DOS Executable Generic (2000/1)
Reporter smica83
Tags:CoinMiner exe HUN

Intelligence

File Origin
# of uploads :
2
# of downloads :
325
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
lbvgkmtzwmke.exe
Verdict:
Malicious activity
Analysis date:
2023-12-19 16:35:35 UTC
Tags:
miner
Link:
https://app.any.run/tasks/70d07bf0-1480-4028-95be-157f55c5ba25

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/468541/
Detection(s):
SecuriteInfo.com.Win64.Evo-gen.5535.10887.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a service
Creating a file
Launching a service
Creating a process from a recently created file
Creating a file in the Windows subdirectories
Launching cmd.exe command interpreter
Searching for synchronization primitives
Loading a system driver
Using the Windows Management Instrumentation requests
Enabling autorun for a service
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug miner
Link:
https://www.filescan.io/uploads/6581c63cb855eb3693e6c276/reports/bb54b05e-97be-4e06-9b15-03d31449a393/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/e479db70018c1524ad4e7134186c418a043d815e13bf29b0b667a4928e6d8cde
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/890b62f7-793a-4ed7-9e66-96ba4dabb03c
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1364675
Signature
Detected Stratum mining protocol
Found strings related to Crypto-Mining
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Snort IDS alert for network traffic
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1364675 Sample: lbvgkmtzwmke.exe Startdate: 19/12/2023 Architecture: WINDOWS Score: 100 43 pool.hashvault.pro 2->43 51 Snort IDS alert for network traffic 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 Multi AV Scanner detection for submitted file 2->55 57 3 other signatures 2->57 9 lbvgkmtzwmke.exe 1 2->9         started        13 lbvgkmtzwmke.exe 2 2->13         started        signatures3 process4 file5 39 C:\Windows\Temp\sakesmwytfaq.sys, PE32+ 9->39 dropped 59 Multi AV Scanner detection for dropped file 9->59 61 Modifies the context of a thread in another process (thread injection) 9->61 63 Sample is not signed and drops a device driver 9->63 15 cmd.exe 9->15         started        19 conhost.exe 9->19         started        41 C:\ProgramData\...\lbvgkmtzwmke.exe, PE32+ 13->41 dropped 21 sc.exe 1 13->21         started        23 sc.exe 1 13->23         started        25 sc.exe 1 13->25         started        27 sc.exe 1 13->27         started        signatures6 process7 dnsIp8 45 142.202.242.45, 49729, 80 1GSERVERSUS Reserved 15->45 47 Query firmware table information (likely to detect VMs) 15->47 49 Found strings related to Crypto-Mining 15->49 29 conhost.exe 21->29         started        31 conhost.exe 23->31         started        33 conhost.exe 25->33         started        35 conhost.exe 27->35         started        signatures9 process10 process11 37 conhost.exe 29->37         started       
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e479db70018c1524ad4e7134186c418a043d815e13bf29b0b667a4928e6d8cde
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e479db70018c1524ad4e7134186c418a043d815e13bf29b0b667a4928e6d8cde/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-12-19 02:14:10 UTC
File Type:
PE+ (Exe)
AV detection:
19 of 23 (82.61%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4r45w4abrqksjlkooe2bq3cbricd3ak6co7stmfwm6sjfdtnrtpa._file
Verdict:
unknown
Similar samples:
04e3926ce6762b1dc0ce2ea8107a36e9bdda11673ae5b333bccb81a72690a3a1
CoinMiner
0bbfe17f684a3946b76fc48fd788b632cac3ad8b4a60ab6207a35d0d80584758
CoinMiner
201fb376d18d216baf555ff6afdc0754f94c4475ceaf3b5c713473833cc60aa5
CoinMiner
e380482fc3d8c4fe11073f9734238d60ab66385e3261231358f7d02082b235cd
CoinMiner
+ 10 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/231219-t3m7dshcg9/
Unpacked files
SH256 hash:
e479db70018c1524ad4e7134186c418a043d815e13bf29b0b667a4928e6d8cde
MD5 hash:
048f76b5840dc202d8d029645c60c5a7
SHA1 hash:
6003c0f93c9d3d1e7f6540f65e87487215addb65
Link:
https://www.unpac.me/results/244cab15-72a0-4feb-abf8-998fa308fd14/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e479db70018c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e479db70018c1524ad4e7134186c418a043d815e13bf29b0b667a4928e6d8cde

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/468541/

Comments