MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 17

Intelligence 17 IOCs YARA 3 File information Comments

SHA256 hash:	e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6
SHA3-384 hash:	a680a518c0e4cac31e9491afa466d443d78a87f163fe42e2c2549c975fe5e574d89cec46896111514bc12cb1e07999ec
SHA1 hash:	26f8b075c7df48eeec5d9aec593410ba87ffd559
MD5 hash:	b3c4004238ef139fe90b5f8041ada1cd
humanhash:	thirteen-minnesota-washington-vegan
File name:	has.exe
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	3'127'302 bytes
First seen:	2024-06-12 18:10:18 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4cfda23baf1e2e983ddfeca47a5c755a (33 x RedLineStealer, 6 x Dridex, 5 x NetSupport)
ssdeep	49152:YKFiWztohDIZZYiOG2qPX4xRgPZcUAtijL+kOqxvDUuPBBVFJt6NGGTDVOXLyago:YKYWJ6sDYI2qPX4fgPZcUAUjSkXvDUin
Threatray	354 similar samples on MalwareBazaar
TLSH	T1FDE5333174A08037E113443587D4D7366879B9349A322A9EFB548B7D7F21EA2C267BB3
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	cdabae6fe6e7eaec (22 x Amadey, 9 x AurotunStealer, 8 x CoinMiner)
Reporter	sentotayam
Tags:	CoinMiner exe miner

Intelligence

File Origin

# of uploads :

# of downloads :

427

Origin country :

Vendor Threat Intelligence

Malware family:

xmrig

ID:

File name:

e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6.exe

Verdict:

Malicious activity

Analysis date:

2024-06-12 18:11:06 UTC

Tags:

miner xmrig

Link:

https://app.any.run/tasks/e099368c-f013-4f2e-b51c-241c90c91974

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.PWS.Stealer.24943.1502.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6669e4aada262547655ebb2awin7simulatehigh_evasion

Tags:

Banker Encryption Execution Generic Network Other Static Stealth Malware Dexter

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the Windows subdirectories

Running batch commands

Creating a process from a recently created file

Creating a service

Launching a process

Launching a service

Enabling the 'hidden' option for recently created files

Launching the process to change the firewall settings

Connection attempt to an infection source

Sending a TCP request to an infection source

Loading a system driver

Enabling autorun for a service

Query of malicious DNS domain

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug byovd coinminer crypto epmicrosoft_visual_cc fingerprint installer lolbin microsoft_visual_cc miner monero netsh overlay packed pup sfx shell32 svchost.exe xmrig

Link:

https://www.filescan.io/uploads/6669e4c0eae3878d8f39501e/reports/57618300-eb1b-41c1-8054-8e6f8b133bf8/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6

Malware family:

XMRig Miner

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f4d0a773-3fd1-48ab-b421-643b5361a882

Result

Threat name:

Xmrig

Detection:

malicious

Classification:

evad.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1456172

Signature

Antivirus detection for dropped file

Detected Stratum mining protocol

Drops executables to the windows directory (C:\Windows) and starts them

Drops PE files with benign system names

Found strings related to Crypto-Mining

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Modifies the windows firewall

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Suspect Svchost Activity

Sigma detected: System File Execution Location Anomaly

Snort IDS alert for network traffic

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Score:

90%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6/

Threat name:

Win32.Trojan.DisguisedXMRigMiner

Status:

Malicious

First seen:

2024-06-03 12:17:34 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 38 (71.05%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=43nalqctoyzdb3dlusgls5wuh4membgzeytzt2w3bqt66ludt3da._file

Verdict:

malicious

CoinMiner

4cd8586d09ba9e97b4e50bb2d9d1e671a50bfe79bcd29ebf851ae6defc8d1768

CoinMiner

59b3af1a244a082219116ed9b496de99236b01ae42df75bf4211ed2b7069bc4b

CoinMiner

a25add458dd5f3d5ea3b8464b19a9a9100a10d58e47f5f0c9e88bfc65052f241

CoinMiner

e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0

CoinMiner

efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

CoinMiner

f71eb13cee017420a630eeaef421c2df8b6b3ab7e164e5bfd57907f182c7c1bd

CoinMiner

+ 344 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig evasion miner

Link:

https://tria.ge/reports/240612-wsk1dsvblf/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Enumerates physical storage devices

Drops file in Windows directory

Launches sc.exe

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Modifies Windows Firewall

Sets file to hidden

XMRig Miner payload

xmrig

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/1f0ef405-e8e2-4e6e-b729-93d4a511dec5

Unpacked files

SH256 hash:

d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4

MD5 hash:

e2fe87cc2c7dab8ca6516620dccd1381

SHA1 hash:

f714ec0448325435103519452610cf7aadf8bbba

Detections:

XMRig

MALWARE_Win_CoinMiner02

XMRIG_Monero_Miner

MAL_XMR_Miner_May19_1

Link:

https://www.unpac.me/results/46a16e5e-57bd-4e85-a642-0f687a3cf55a/

Parent samples :

e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6
e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0
01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83

SH256 hash:

11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

MD5 hash:

0c0195c48b6b8582fa6f6373032118da

SHA1 hash:

d25340ae8e92a6d29f599fef426a2bc1b5217299

Detections:

PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD

Link:

https://www.unpac.me/results/46a16e5e-57bd-4e85-a642-0f687a3cf55a/

Parent samples :

efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8
40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779
e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6
e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0
01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83
f49dd9baed6ec113ad16bcd07e50ab5dc1ca98ef4797712cbf3f2f5463a16d41
22289a61cd8a347a03da845d34820534b3e617781447a91c6a0fb3b1e6f6a184
21690a716f4d4f3af3ad00504dfd41ef4d11a5663ff96c3365838896ffcaedd7
c7eaff9d735d8eef42c73be4c093f7b31cf7d0df18c98d135eb915c13409d077
235c665b25c1e78fed3ca96e57c374e5a416aad1d27b4ae436a1c6c58604268b
c8a83c6c8f797e36eb7a5edf0e5f85a8d985895c82932422b95bf628f4106dfb
ed3ce2006fbfa402977bb026324637b905c5cc8228254b88037d3f68152463d3
a7a9d6a874f65ea3689930a2af208a025fee0a3dc1ad5cb9c964cbadd2cacf1f
67bf6d0a4de17f79de1347b75c9d1af3106448a806132cf50b38c2c8aa19d8ea
254a713d3ec2852b6657ecb8840efd2662e048ace42c2b4e0b30c589cdb9f8cb
6353b1218561a746bb3e009b611a1945bc2367b4d3ffef7849d4af4d369f184c
4f85b6d87dcc12f7904f95f3716b18930c63cb18bd624c1abcbdd9181ba4efc2
e93433169e2ec088a21ee58ae3e780f68215eb75dcd31b83d1fa31d6c16145e5
1214268764f9252ca840f1cc7e9b3698ed55f059802fa7ab7442f61144d898d0
803b90be4767757819d2be13b6d6a36d1af1383495a31a5932cfd50bacb4c717
9a2476c6474745cfacee35d15a3d4034d8d254304be3fa17a170ec0af9f9077e
84b896f2d6f255b3e0130be2b4a3892e16b8970dd47e8da0cf8ad5271fd86c95
c1dd42c5d06153184430f7b1843200d21308e78ce9403c99f7b18c8682acabca
0714af49edc930cea4e4d0345090d71f04ce97093bd487a9ce36e1b18d27f8d2

SH256 hash:

17e5d5eff1ce02a07ee5cdba9536bb2725c96b45884a91e2db67c3ddc7244383

MD5 hash:

ecacebfe705ada02667134be9d0b8d6a

SHA1 hash:

3f0e69671ef48a8776f4385bc172acd1174b9af5

Link:

https://www.unpac.me/results/46a16e5e-57bd-4e85-a642-0f687a3cf55a/

SH256 hash:

e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6

MD5 hash:

b3c4004238ef139fe90b5f8041ada1cd

SHA1 hash:

26f8b075c7df48eeec5d9aec593410ba87ffd559

Link:

https://www.unpac.me/results/46a16e5e-57bd-4e85-a642-0f687a3cf55a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

exe e6da05c053763230ec6ba48cb976d43f184604d9262799eadb0c27ef2e839ec6

(this sample)

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance ole32.dll::CreateStreamOnHGlobal
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::SetFileSecurityW
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExW SHELL32.dll::SHFileOperationW SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_API	Can Create Process and Threads	ADVAPI32.dll::OpenProcessToken KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineW KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::WriteConsoleA KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW KERNEL32.dll::CreateFileMappingW KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileA KERNEL32.dll::DeleteFileW
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::FindWindowExW USER32.dll::PeekMessageW USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample