MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0dcfbc6e7f23dc6c462cee30de2873dd1b907bdce88ffa647c44ab2ace75338. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0dcfbc6e7f23dc6c462cee30de2873dd1b907bdce88ffa647c44ab2ace75338
SHA3-384 hash: 9770417e29ea7927a7afa48b190ce47aec6d7e233b59504737229c21fcbf04a4dc021bdd43b7bd7359b17dfcdbae1000
SHA1 hash: f153f4003589e0db9c2fbc9ea757381bb0c046db
MD5 hash: 7d1846beef1a0c3b7f4f7ff564b55ffa
humanhash: zulu-thirteen-sodium-hawaii
File name:file
Download: download sample
Signature CoinMiner
Create hunting rule
File size:802'816 bytes
First seen:2023-01-11 06:55:03 UTC
Last seen:2023-01-11 08:34:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 09de21dc5ad42436b12d4ca9754397fd (3 x CoinMiner)
ssdeep 12288:Yx3LOt3Wv5SnOtpIfFQbqXlPIrA2SMQKa94jLky8rMSNVL3OeSr:WOtmv5SnOtp4YrOdqcES7
Threatray 2'686 similar samples on MalwareBazaar
TLSH T1DF05CE6A7574C162F0FCD3B3D566E6F219AA2CF7C990411B93F03E6F3672220D15A21A
Reporter andretavare5
Tags:CoinMiner exe


Avatar
andretavare5
Sample downloaded from http://orderedami.com/svcrun.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-01-11 06:57:16 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/dc772c2e-890e-4123-9ac8-e2c7060baee6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/351816/
Detection(s):
Can't access file ERROR
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Creating a file
Enabling the 'hidden' option for recently created files
Using the Windows Management Instrumentation requests
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63be5d49fc9525ae8a4536e9/reports/4926cb5f-806b-4cb5-b627-a3aa28e7c3ae/overview
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d25d978f-52d2-41a2-8ea8-447fac7b4fac
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1149391
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Contains functionality to detect virtual machines (IN, VMware)
Detected unpacking (changes PE section rights)
DNS related to crypt mining pools
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sets debug register (to hijack the execution of another thread)
Sigma detected: Xmrig
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 782123 Sample: file.exe Startdate: 11/01/2023 Architecture: WINDOWS Score: 100 45 xmr-eu1.nanopool.org 2->45 51 Sigma detected: Xmrig 2->51 53 Multi AV Scanner detection for domain / URL 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 7 other signatures 2->57 8 file.exe 14 7 2->8         started        13 NLJZH.exe 4 2->13         started        15 NLJZH.exe 2->15         started        17 svchost.exe 2->17         started        signatures3 process4 dnsIp5 49 179.43.141.116, 49851, 80 PLI-ASCH Panama 8->49 43 C:\ProgramData\googleApp43LJZH.exe, MS-DOS 8->43 dropped 63 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->63 65 Sets debug register (to hijack the execution of another thread) 8->65 67 Writes to foreign memory regions 8->67 75 2 other signatures 8->75 19 cmd.exe 1 8->19         started        22 vbc.exe 8->22         started        25 powershell.exe 28 8->25         started        69 Detected unpacking (changes PE section rights) 13->69 71 Contains functionality to detect virtual machines (IN, VMware) 13->71 73 Adds a directory exclusion to Windows Defender 13->73 27 cmd.exe 1 13->27         started        29 powershell.exe 13->29         started        file6 signatures7 process8 dnsIp9 59 Uses schtasks.exe or at.exe to add and modify task schedules 19->59 31 conhost.exe 19->31         started        33 schtasks.exe 1 19->33         started        47 51.68.143.81, 14433, 49853 OVHFR France 22->47 61 Query firmware table information (likely to detect VMs) 22->61 35 conhost.exe 25->35         started        37 conhost.exe 27->37         started        39 schtasks.exe 1 27->39         started        41 conhost.exe 29->41         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0dcfbc6e7f23dc6c462cee30de2873dd1b907bdce88ffa647c44ab2ace75338/
Threat name:
Win64.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-01-11 06:56:10 UTC
File Type:
PE+ (Exe)
Extracted files:
28
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6dopxrxh6i64nrdcz3rq3yuhhxi3sb55z2ep7jshyrflflhhkm4a._file
Verdict:
unknown
Similar samples:
0553b9c8c8e734222ec8c7ce0e8fdc4c09da333747f65f670164e73acafb2582
CoinMiner
31d2e100660e3792c3249ae54d6719bcfe8fb28e5a02de40749994a96c4e9378
CoinMiner
4a41f8f731cbcc12964701358e0bf99d73c928ccb69a53dce19441ab7bc90f3c
CoinMiner
4b667458aed21d12092e836634f5df93bde73e70bff78f7d2b0d96cd70e208bc
CoinMiner
5a6f5d425060a2bfc152e1c2673991151e8863354deb3c4febd60ce42a80f35e
CoinMiner
9769e2435c9a91010f491ccf07608d47aec7ddc4bb3db4eea76bdf9306dc5d24
CoinMiner
ac33a4954a11cabb9fce2e006d671f385b136f51453eec5b63456bcc6d50171d
CoinMiner
b3e90cc7ab8a0216ccd9ca97bff05f88c7d70686604490a458a2aabf72a52bfb
CoinMiner
d2b55acbf3aa2b30df7033794577c5cf5ebd57a4372e4f64c32bfb5b5445ca6d
CoinMiner
ec42d6bd2c85b212490626ad7937baa22415114b9ff92e46d2f8d45d945bd1e6
CoinMiner
+ 2'676 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig miner
Link:
https://tria.ge/reports/230111-hpsn6sef41/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Checks computer location settings
Uses the VBS compiler for execution
XMRig Miner payload
xmrig
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5bba0f4a-2ccb-4595-9d11-1c45cb7114d8
Unpacked files
SH256 hash:
f0dcfbc6e7f23dc6c462cee30de2873dd1b907bdce88ffa647c44ab2ace75338
MD5 hash:
7d1846beef1a0c3b7f4f7ff564b55ffa
SHA1 hash:
f153f4003589e0db9c2fbc9ea757381bb0c046db
Link:
https://www.unpac.me/results/0677bae2-ab40-4107-8402-94b26b318afb/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f0dcfbc6e7f2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f0dcfbc6e7f23dc6c462cee30de2873dd1b907bdce88ffa647c44ab2ace75338

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BAZT_B5_NOCEXInvalidStream
Create hunting rule
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/351816/
  
URLhaus
https://urlhaus.abuse.ch/url/2497706/

Comments