MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fad94d50a5980d5684226b644ab844053d7b8555d27a9e9ee1ce58eadebb067a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fad94d50a5980d5684226b644ab844053d7b8555d27a9e9ee1ce58eadebb067a
SHA3-384 hash: 761ec27491bd354fabc1d1d8ff41c4f76ff6493d8caeedfeeb56b1b999aba4c8f054423e6fc38119f04522bb2b5f4b30
SHA1 hash: d61987f3be28a43459701aa469d371502d8f185e
MD5 hash: 0a88d1777e0b1f24c646ab5060ef8d78
humanhash: hamper-bravo-emma-mars
File name:0a88d1777e0b1f24c646ab5060ef8d78
Download: download sample
Signature CoinMiner
Create hunting rule
File size:2'045'726 bytes
First seen:2021-11-14 07:39:49 UTC
Last seen:2021-11-14 09:56:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 02549ff92b49cce693542fc9afb10102 (87 x CoinMiner, 2 x CoinMiner.XMRig, 1 x AgentTesla)
ssdeep 49152:9jZPYdDZPBHMWy8SYuMwc8YzzCkO7Du7lNXNi8U5zD9QabN0K:DaP6Wy8JwcDzOvu5NdiDdG20
Threatray 7 similar samples on MalwareBazaar
TLSH T1CA9533639E95930CF87C1133B0820D02AB943B5185E0F31D6CCA5BB9657AEB5EFA0D9D
Reporter zbetcheckin
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
175
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/205650/
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.14789.24302.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Running batch commands
Launching a process
Sending a UDP request
Creating a process from a recently created file
Creating a process with a hidden window
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/6190bd57a00afa9663a701ce/reports/b9beadbc-79ab-4a41-a36f-2383a4499086/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/eeb9f5b1-8247-4e87-a1f4-405a4d17df5d
Result
Threat name:
BitCoin Miner
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/888824
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Drops PE files to the user root directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected BitCoin Miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 521297 Sample: iSfbnMXULq Startdate: 14/11/2021 Architecture: WINDOWS Score: 84 46 Multi AV Scanner detection for submitted file 2->46 48 Yara detected BitCoin Miner 2->48 9 iSfbnMXULq.exe 2->9         started        12 services32.exe 2->12         started        process3 signatures4 60 Writes to foreign memory regions 9->60 62 Allocates memory in foreign processes 9->62 64 Creates a thread in another existing process (thread injection) 9->64 14 conhost.exe 5 9->14         started        66 Multi AV Scanner detection for dropped file 12->66 18 conhost.exe 5 12->18         started        process5 file6 40 C:\Users\user\services32.exe, PE32+ 14->40 dropped 42 C:\Users\...\services32.exe:Zone.Identifier, ASCII 14->42 dropped 74 Drops PE files to the user root directory 14->74 20 cmd.exe 1 14->20         started        22 cmd.exe 1 14->22         started        44 C:\Users\user\AppData\...\sihost32.exe, PE32+ 18->44 dropped 25 sihost32.exe 18->25         started        signatures7 process8 signatures9 27 services32.exe 20->27         started        30 conhost.exe 20->30         started        50 Uses schtasks.exe or at.exe to add and modify task schedules 22->50 32 conhost.exe 22->32         started        34 schtasks.exe 1 22->34         started        52 Multi AV Scanner detection for dropped file 25->52 54 Writes to foreign memory regions 25->54 56 Allocates memory in foreign processes 25->56 58 Creates a thread in another existing process (thread injection) 25->58 36 conhost.exe 2 25->36         started        process10 signatures11 68 Writes to foreign memory regions 27->68 70 Allocates memory in foreign processes 27->70 72 Creates a thread in another existing process (thread injection) 27->72 38 conhost.exe 2 27->38         started        process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fad94d50a5980d5684226b644ab844053d7b8555d27a9e9ee1ce58eadebb067a/
Threat name:
Win64.Trojan.Donut
Create hunting rule
Status:
Malicious
First seen:
2021-11-14 07:40:09 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0221c396bd17917621bb6bd04a09a07e5e00389c25677bb3af7170cb858a9ea4
CoinMiner
06b9c1418f1db6092d2f85eed6f479a667e4901accb6bbe789545c247d588232
CoinMiner
1fb1982ea5a8d329048f3ff1ac72b2050db15c8eed5e971dc9f54d1187221105
CoinMiner
d3f77ae659c38c08c8c39fde6c8e5900817e2032b5b8e96de98811b00889b486
CoinMiner
f3580c945b60d9f9b43c886f0f86244308c4ec859b6b3e005e5ebc2315ff0f0b
CoinMiner
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/211114-jhjy5agag9/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
fad94d50a5980d5684226b644ab844053d7b8555d27a9e9ee1ce58eadebb067a
MD5 hash:
0a88d1777e0b1f24c646ab5060ef8d78
SHA1 hash:
d61987f3be28a43459701aa469d371502d8f185e
Link:
https://www.unpac.me/results/886d9ea5-de1f-4c9b-8e6b-8c695966c9fc/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/fad94d50a598/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe fad94d50a5980d5684226b644ab844053d7b8555d27a9e9ee1ce58eadebb067a

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/205650/

Comments


Avatar
zbet commented on 2021-11-14 07:39:51 UTC

url : hxxp://91.243.32.23:7766/sys32.exe