🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f721b4e5cdae494fceec605a3cffbf5824341258b43660cd1c9fe72c691a9594. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 9


Intelligence 9 IOCs 5 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f721b4e5cdae494fceec605a3cffbf5824341258b43660cd1c9fe72c691a9594
SHA3-384 hash: f62734b7b635b562bb133dc7d40aeb329703ca8527d136d41577e5578f143c966d8460825718d0503e97d7c0dc204353
SHA1 hash: be6beef6c4608d8675b983183f5556ced9be0692
MD5 hash: 7041130b7052851e0753ec72d7e95f52
humanhash: twelve-eighteen-lake-edward
File name:7041130b7052851e0753ec72d7e95f52.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:120'832 bytes
First seen:2021-09-25 07:35:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cff62fa5d60c26268b201fcb5b9dc813 (28 x RedLineStealer, 19 x RaccoonStealer, 4 x Stop)
ssdeep 3072:pEabqYnqDEySanNPjCZQ+1D55M4KCrx+KKY5:iambg4cqCNQ
Threatray 6'475 similar samples on MalwareBazaar
TLSH T136C39D2035F18432EEF756750B39D3E55E3BBC336A70418B76A4265ACE216E0BE26353
File icon (PE):PE icon
dhash icon 480c1c4c4f590914 (3 x RedLineStealer, 1 x CoinMiner, 1 x RaccoonStealer)
Reporter abuse_ch
Tags:CoinMiner exe


Avatar
abuse_ch
CoinMiner C2:
http://5.252.178.152/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://5.252.178.152/ https://threatfox.abuse.ch/ioc/226423/
135.181.142.223:30397 https://threatfox.abuse.ch/ioc/226444/
178.132.3.103:80 https://threatfox.abuse.ch/ioc/226445/
65.21.231.57:60751 https://threatfox.abuse.ch/ioc/226446/
92.222.145.232:61157 https://threatfox.abuse.ch/ioc/226447/

Intelligence

File Origin
# of uploads :
1
# of downloads :
188
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7041130b7052851e0753ec72d7e95f52.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-25 07:41:48 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/dcbeb4b3-2bbf-4b3f-ac86-c63b60b5c4cc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/191346/
Detection(s):
Win.Malware.Generic-9896928-0
Create hunting rule

Win.Packed.Generic-9896741-0
Create hunting rule

Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a44bcdb1-3767-41a2-a804-071a7739ba88
Result
Threat name:
Raccoon RedLine SmokeLoader Tofsee
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/857807
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Benign windows process drops PE files
Changes security center settings (notifications, updates, antivirus, firewall)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 490238 Sample: 630WKhxk3M.exe Startdate: 25/09/2021 Architecture: WINDOWS Score: 100 75 defeatwax.ru 2->75 77 api.ip.sb 2->77 91 Antivirus detection for dropped file 2->91 93 Multi AV Scanner detection for submitted file 2->93 95 Yara detected SmokeLoader 2->95 97 11 other signatures 2->97 11 630WKhxk3M.exe 2->11         started        14 afsuhjv 2->14         started        16 svchost.exe 2->16         started        18 8 other processes 2->18 signatures3 process4 dnsIp5 129 Detected unpacking (changes PE section rights) 11->129 131 Contains functionality to inject code into remote processes 11->131 133 Injects a PE file into a foreign processes 11->133 21 630WKhxk3M.exe 11->21         started        135 Multi AV Scanner detection for dropped file 14->135 137 Machine Learning detection for dropped file 14->137 24 afsuhjv 14->24         started        139 Changes security center settings (notifications, updates, antivirus, firewall) 16->139 26 MpCmdRun.exe 1 16->26         started        79 192.168.2.1 unknown unknown 18->79 signatures6 process7 signatures8 121 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 21->121 123 Maps a DLL or memory area into another process 21->123 125 Checks if the current machine is a virtual machine (disk enumeration) 21->125 127 Creates a thread in another existing process (thread injection) 21->127 28 explorer.exe 12 21->28 injected 33 conhost.exe 26->33         started        process9 dnsIp10 85 193.56.146.41, 49812, 9080 LVLT-10753US unknown 28->85 87 216.128.137.31, 80 AS-CHOOPAUS United States 28->87 89 3 other IPs or domains 28->89 67 C:\Users\user\AppData\Roaming\afsuhjv, PE32 28->67 dropped 69 C:\Users\user\AppData\Local\Temp\D72E.exe, PE32 28->69 dropped 71 C:\Users\user\AppData\Local\Temp\C78D.exe, PE32 28->71 dropped 73 4 other malicious files 28->73 dropped 141 System process connects to network (likely due to code injection or exploit) 28->141 143 Benign windows process drops PE files 28->143 145 Deletes itself after installation 28->145 147 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->147 35 22D.exe 28->35         started        38 D72E.exe 28->38         started        40 2E31.exe 1 28->40         started        42 5 other processes 28->42 file11 signatures12 process13 dnsIp14 99 Detected unpacking (changes PE section rights) 35->99 101 Machine Learning detection for dropped file 35->101 46 22D.exe 35->46         started        103 Multi AV Scanner detection for dropped file 38->103 105 Query firmware table information (likely to detect VMs) 38->105 107 Tries to detect sandboxes and other dynamic analysis tools (window names) 38->107 49 conhost.exe 38->49         started        109 Hides threads from debuggers 40->109 111 Tries to detect sandboxes / dynamic malware analysis system (registry check) 40->111 51 conhost.exe 40->51         started        81 t.me 149.154.167.99, 443, 49844 TELEGRAMRU United Kingdom 42->81 83 5.252.178.152, 49846, 80 MIVOCLOUDMD Moldova Republic of 42->83 63 C:\Users\user\AppData\Local\...\hkdljltd.exe, PE32 42->63 dropped 65 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 42->65 dropped 113 Antivirus detection for dropped file 42->113 115 Detected unpacking (overwrites its own PE header) 42->115 117 Tries to harvest and steal browser information (history, passwords, etc) 42->117 119 2 other signatures 42->119 53 cmd.exe 42->53         started        55 B37.exe 2 42->55         started        57 conhost.exe 42->57         started        59 conhost.exe 42->59         started        file15 signatures16 process17 signatures18 149 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 46->149 151 Maps a DLL or memory area into another process 46->151 153 Checks if the current machine is a virtual machine (disk enumeration) 46->153 155 Creates a thread in another existing process (thread injection) 46->155 61 conhost.exe 53->61         started        process19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f721b4e5cdae494fceec605a3cffbf5824341258b43660cd1c9fe72c691a9594/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2021-09-25 01:49:49 UTC
AV detection:
18 of 45 (40.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=64q3jzonvzeu7txmmbndz757lasdiesywq3gbti4t7tsy2i2swka._file
Verdict:
malicious
Similar samples:
133304b5052863dc2916413ac706f13189ac5a40698bdcbc30f2ed82dd99a1eb
CoinMiner
1d53ebef1fc30a9213f181ccb214dbe43703474dd6428fef873a1c439f146223
CoinMiner
39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b
CoinMiner
7dc5a00ea0996d4edb8fbee2a9d2caa97ece60b4d5f755c3e82a06205ee2a385
CoinMiner
843140b0a3f095d74fe2682d3ae029d4da70a5bae79850cf047a72c9d4a882c0
CoinMiner
8fe0e96079608b65906be8b65e589d44d73d1b46de789752c5ec47e79d3976c6
CoinMiner
a98b37b337927ef6cea8a053a4ea676646de4dfbf6ce9619593246a1ecc362b6
CoinMiner
e3d023e5f6f2e7eebfb12204edd3ac526e830ecc051cfbf9fc9ed24d8dc7d143
CoinMiner
f8eee2152f76d73d0eaa7be03d1232fdf15cf798167f43f06f4a58751780cd8a
CoinMiner
f9edbff29a53d95b7eb874b4db8cc83cae6c61f8c7e1d79176d68bf09a842167
CoinMiner
+ 6'465 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:arkei family:raccoon family:redline family:smokeloader family:tofsee family:xmrig botnet:5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 botnet:700$ botnet:qq botnet:vol backdoor discovery evasion infostealer miner persistence spyware stealer themida trojan
Link:
https://tria.ge/reports/210925-jfabxaagb8/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Modifies registry class
Modifies data under HKEY_USERS
Delays execution with timeout.exe
Checks processor information in registry
Checks SCSI registry key(s)
Program crash
Enumerates physical storage devices
Launches sc.exe
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops file in System32 directory
Checks whether UAC is enabled
Checks installed software on the system
Accesses cryptocurrency files/wallets, possible credential harvesting
Themida packer
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Loads dropped DLL
Deletes itself
Checks BIOS information in registry
Sets service image path in registry
Modifies Windows Firewall
Executes dropped EXE
Downloads MZ/PE file
Creates new service(s)
XMRig Miner Payload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Arkei Stealer Payload
xmrig
Windows security bypass
Tofsee
SmokeLoader
RedLine Payload
RedLine
Raccoon
Arkei
Malware Config
C2 Extraction:
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
135.181.142.223:30397
178.132.3.103:80
65.21.231.57:60751
92.222.145.232:61157
Unpacked files
SH256 hash:
2fead9437f15e057951fd6a02ab05076e38db13483df0191787c21c79343b9e7
MD5 hash:
1c90f3a3fcd93ee08b2154cbcff49085
SHA1 hash:
73ac881633a13c3c31c1153d8105b8ecbb60961e
Link:
https://www.unpac.me/results/eacaf3c3-edb7-4f60-ad78-97c071ec0f7e/
SH256 hash:
f721b4e5cdae494fceec605a3cffbf5824341258b43660cd1c9fe72c691a9594
MD5 hash:
7041130b7052851e0753ec72d7e95f52
SHA1 hash:
be6beef6c4608d8675b983183f5556ced9be0692
Link:
https://www.unpac.me/results/eacaf3c3-edb7-4f60-ad78-97c071ec0f7e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/f721b4e5cdae/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f721b4e5cdae494fceec605a3cffbf5824341258b43660cd1c9fe72c691a9594

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe f721b4e5cdae494fceec605a3cffbf5824341258b43660cd1c9fe72c691a9594

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1639930/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/191346/

Comments