MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 facfe6d03ae63e1cb28ac57bcbc366a17b1d7dea227dbb87de6d0cb98bb53feb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
CoinMiner
Vendor detections: 10
| SHA256 hash: | facfe6d03ae63e1cb28ac57bcbc366a17b1d7dea227dbb87de6d0cb98bb53feb |
|---|---|
| SHA3-384 hash: | 936c5bc5d08041d7ae8f01b1a98d77842b189dde760ff0970d3e2f07f7587346e6a32a457c87188212daeb667ef985cd |
| SHA1 hash: | 6ae50e721f3c23dbb8928620fc9d9370c7755df8 |
| MD5 hash: | 3a35f2315dc33b6cdba331ec662fad0a |
| humanhash: | yellow-floor-montana-vermont |
| File name: | 64RasftubyGen11.exe |
| Download: | download sample |
| Signature | CoinMiner |
| File size: | 1'765'336 bytes |
| First seen: | 2022-03-07 05:30:40 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 027ea80e8125c6dda271246922d4c3b0 (10 x njrat, 7 x DCRat, 5 x DarkComet) |
| ssdeep | 24576:kmoO8ituuZgHt+PwYsK3kgytvU3pQLdrEHPWh/jVc4GBcBMasKZ29LcbnpmTUWoI:vvZgqJ3Et8gSHuhhc4ccRsK29WnpmroI |
| Threatray | 6'846 similar samples on MalwareBazaar |
| TLSH | T1DB852302EBD184B2D42255364D197751A27CBE301F18CA5FF78C3E6DA8751B27722EA3 |
| File icon (PE): |  |
| dhash icon | 71f0e8e8e8e8f069 (1 x CoinMiner) |
| Reporter |  adm1n_usa32 |
| Tags: | CoinMiner exe hacktool UFR UFRStealer |
Intelligence
File Origin
# of uploads :
1
# of downloads :
394
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
64RasftubyGen11.exe
Verdict:
Malicious activity
Analysis date:
2022-03-07 05:27:53 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Running batch commands
Creating a process from a recently created file
Creating a file in the %temp% subdirectories
Enabling the 'hidden' option for files in the %temp% directory
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Crypto Miner Xmrig
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Signature
Antivirus detection for dropped file
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found strings related to Crypto-Mining
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Windows Crypto Mining Indicators
Sigma detected: Xmrig
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected Crypto Miner
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Rasftuby
Status:
Malicious
First seen:
2022-02-23 02:28:00 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
21 of 27 (77.78%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 6'836 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
9/10
Tags:
miner persistence upx
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Cryptocurrency Miner
Loads dropped DLL
Executes dropped EXE
UPX packed file
Detected Stratum cryptominer command
Unpacked files
SH256 hash:
e8dbf4265d2059720c254a20b64954a571c8b3589fabb9d1904ccca875452ad7
MD5 hash:
7a36cc0247077b74cfac575d14de01c3
SHA1 hash:
22179793a3873cfb289763a765816672374526e7
SH256 hash:
f486b902a2face8f1823b985e900f2852f862438e6848bad61746d5309ba797b
MD5 hash:
2debb1650265f25b2896551b35ba019d
SHA1 hash:
537de104cd1a7ec647b0dd87ae5c02dd33a03aec
SH256 hash:
8fdc0cf562b7d92f17a0830346341877a20fc4563b91960d5446a1baf58000cd
MD5 hash:
cfa6664e8258848b1019f12b80bfd7aa
SHA1 hash:
ba3635c74feb5cd06768c450fc0145f1d0c33c41
Detections:
win_ufrstealer_auto
SH256 hash:
aafc17ce15cc9f1d01a50a3f419cf9fa2721e18831189dd226b78df41b113d2e
MD5 hash:
f5f0791b948b95cab35448635ea6d2f6
SHA1 hash:
837261be22e3de48f354d2d094ffbc0d56e06e7e
SH256 hash:
facfe6d03ae63e1cb28ac57bcbc366a17b1d7dea227dbb87de6d0cb98bb53feb
MD5 hash:
3a35f2315dc33b6cdba331ec662fad0a
SHA1 hash:
6ae50e721f3c23dbb8928620fc9d9370c7755df8
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.