MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbca0b953516798fdf230b0369f5d19b7111f483aa3895177875750428628969. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbca0b953516798fdf230b0369f5d19b7111f483aa3895177875750428628969
SHA3-384 hash: 766e60d3330b38fe068916be1d59c045aa8234db04a8e535dd7da48ed98b818863ab0759b816bc016e340c1bc1356359
SHA1 hash: 9a4478b681c86dacde3b1e62ef2d111574fe816b
MD5 hash: 472afcfc669c79a606a8e95732492944
humanhash: lion-carpet-april-summer
File name:472afcfc669c79a606a8e95732492944.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:1'999'896 bytes
First seen:2022-02-01 16:26:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b78ecf47c0a3e24a6f4af114e2d1f5de (295 x GuLoader, 23 x Formbook, 21 x RemcosRAT)
ssdeep 49152:eGFn5/3ytf4gvZl1kBrRVdGQDtuhOh47FsACIyM:3FnItfLvZl+BrRVoQkFs3IX
TLSH T1B295330AB3F0EE4DE1577672B82B63392778EA5691C21E83A3064F58DC13922E57F107
File icon (PE):PE icon
dhash icon 69ccd4d49696cc71 (13 x Adware.Adload, 8 x CoinMiner, 7 x ValleyRAT)
Reporter abuse_ch
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
214
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://f0628232.xsph.ru/setup.exe
Verdict:
Malicious activity
Analysis date:
2022-02-01 22:57:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5c73f839-926c-4828-a8b5-2161a56e8337

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/229218/
Detection(s):
PUA.Win.Packer.Exe-6
Create hunting rule

SecuriteInfo.com.BackDoor.Siggen2.2488.26461.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a file in the Windows directory
Creating a service
Launching a service
Creating a process from a recently created file
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
DNS request
Launching the process to interact with network services
Enabling autorun for a service
Sending a TCP request to an infection source
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/5689/overview
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/61f95f6218d1bfdde4e74873/reports/70faffce-b08e-4c9b-a165-d26495e502d6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c9a58590-5e0e-4974-bda6-0ecef4df32d5
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/931941
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Disables security and backup related services
Drops executables to the windows directory (C:\Windows) and starts them
Found strings related to Crypto-Mining
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 564415 Sample: suvbS8TVml.exe Startdate: 01/02/2022 Architecture: WINDOWS Score: 92 54 Antivirus / Scanner detection for submitted sample 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 Yara detected Xmrig cryptocurrency miner 2->58 60 3 other signatures 2->60 8 suvbS8TVml.exe 1 17 2->8         started        12 Client.exe 2->12         started        14 svchost.exe 1 2->14         started        16 3 other processes 2->16 process3 file4 48 C:\Windows\Client.exe, PE32 8->48 dropped 50 C:\Users\user\AppData\Local\...\nsProcess.dll, PE32 8->50 dropped 52 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 8->52 dropped 62 Disables security and backup related services 8->62 18 cmd.exe 1 8->18         started        20 cmd.exe 1 8->20         started        22 cmd.exe 1 8->22         started        24 3 other processes 8->24 64 Antivirus detection for dropped file 12->64 66 Machine Learning detection for dropped file 12->66 signatures5 process6 process7 26 net.exe 1 18->26         started        28 conhost.exe 18->28         started        30 net.exe 1 20->30         started        32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        36 sc.exe 1 22->36         started        38 conhost.exe 24->38         started        40 conhost.exe 24->40         started        42 4 other processes 24->42 process8 44 net1.exe 1 26->44         started        46 net1.exe 1 30->46         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fbca0b953516798fdf230b0369f5d19b7111f483aa3895177875750428628969/
Threat name:
Win32.Trojan.Phonzy
Create hunting rule
Status:
Malicious
First seen:
2022-02-01 16:27:18 UTC
File Type:
PE (Exe)
Extracted files:
44
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Verdict:
malicious
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220201-tx31nahder/
Unpacked files
SH256 hash:
a0827215d60e2ba7f7c4c1465a865bb8cdd7076019b5b3212a20d777020288cd
MD5 hash:
f9d14a9225139df194145657d6b3c04c
SHA1 hash:
d3b1fc4277b3da385cb255b177bf8a43c2677a68
Link:
https://www.unpac.me/results/62a78af0-0985-4b0b-a143-2bbdb088e0c3/
SH256 hash:
aadb42162f6d129f7dd6dad6eb0732cd13691723e8fadaa527bb471852a8225e
MD5 hash:
a48896a867e78601bb8b5e4de953ddbb
SHA1 hash:
3a8b158f44d73a2b2f7773e4c28bb81abadc1e2a
Detections:
win_flawedammyy_auto
Create hunting rule
Link:
https://www.unpac.me/results/62a78af0-0985-4b0b-a143-2bbdb088e0c3/
Parent samples :
b8ac779bad0064cb5e6371e1b1e745bbf9a7751f95d77729c2f461c5a2fc185e
715e1eb5414e749e16fb3999dda7bcf8405e6fb4e14e66ddcbdf20a2e1af89c3
f48f29b77d06f3c8617af598413f5b697a3c0569d6ac959e80fec1a4ea499cea
42d8660460520cc995d9e871953c424a6a95cba8796fa763fb9ebe46cbc7189d
31e7af388e46bad588bf2379082be9883c32d4b4800d162ffba41d703ac1324d
625c963b2ec2c5ba33d9594a83f8ed4fa8ff82a908eb7e1838474b444700227f
715db42221c14aa82c84b459a511f7348f7b07135ffa9d97224c75e11607e1f6
fbca0b953516798fdf230b0369f5d19b7111f483aa3895177875750428628969
0086c66858a198ea8faf61cb24aced32f4948857ba33ca355a6d59b8c5eda1a0
64d216f6d652835b46d87fd8fe6498c60331050c727c7f1d0ceef6aa14e19410
0edacb001024ad548cefbdb4125260b3514cbcb3af12c1706710ed0086643800
f47b3b55aeedf0cb93b1fed30fd944675e81892a235771019208ae95a3753bb9
292448122c421fa603e529ff0a9c3ecfbe46f90bc8287b3d5f23cd0edc6e37a2
31e7acfaa26644d4e5cc0222b451fdd8ddada99cf2f5916db523535c84253337
b00ca61d826c55818d7a94496dd3b9f50c8a4337b9aaed7e390f4ea0fc3571fc
bb6b9431e289c8cca7a359c5e685a81cba52cf86506cfb28bf7fe6c6df8cbc22
0342c1457d9394f575a311a7b5e2557860289a71c90ed0f5736e8410f5849d59
1f92687fb627588ff2e0b4347c0fc634c4b8b84cc45ca138d0b4c59c3ca2df96
e1c5a87cc499041cbf2023a33d0247d4f06ab043df4aa7c68e3e8ffbdbc18942
f70bfbedcea0620a8788cf7f24134f3da0f531eabd1167bb2a5c8d3bb240fdad
9eddf41c4a04d6f1a7510480bab531956b0d5efc55e43f2af52255bb8c2d09c9
0c09174880f7ca0d0d521dfe118d5077c78270973a1437490f91b60c39095927
91c2e0730c8d4f84cd8095c2b21ab42046d6248ca1b068afc02cf41769b5dfda
652882e3911376b2de4213cc09b70ffd0be4c65cb287103e0e2f3e870df05e6c
0fc5e945316b1be00f0fdf8db159fb3613b2d607e4f7ed709658fe48fd7c83d7
c4551e042ed762ccdfb8b20b3f0f9bcc7291a13644a3b0e0335b7e4bedf8e67d
e2fe236e6e2b1abaccc15b23a60e5b3d0cdc171d1ef4de601e469ddcf3919596
8ed63aac9e5077fe47d2593c87081b744ee3d24ca42debe78cf1e457c3782bc1
fcfaa484a545ec70c0ba2d1c9fe254c558542b9e24265135eef209e0ecab974d
48e93693d74276876c042200c63085698360132663e726f775c13d9eeeba57d2
5d0c88af4fe9438facc977b77ca0e791eee35f88049a6be27030377e315eb7ca
f1d545ed6ad2433790b985ad84d102f937b16f44c09f32d9be33f95ef80b7d4d
06bbd56f97c98fe910af5904b60443fcbf1d88488f374f35d4a0423f045c7b4f
78da61841f3d842ae810eea3f098fefbc613cbc76caf95c7dd9851c4215dff91
39e56a2169bb25abac476b5625fda3a78acc1ce3d5f1cba2c92677ab5ec639ea
fb4acd018acf7a2682ea82e941f8167c2008bbdb7fec77ef8fc91d786835c309
f72c3f7de179428b510f8cd6149243e9e9c1783f1de7be02b1cd71b4cf7fb9ec
162b7b0fd94ffc2207532577ce05c80eb3ce52ad5009941ccd0a9a8736980f4e
ae9f6648c124d034c969585a244ed7819bd787d640bd1561e7a6fabf6988476a
dd6c1c1b528f95923c4b501a1b603a28e00338dfa239cadbc8af87e441f047f8
61cd040366ea4116433848a0fab8e737da6e7e1f32f14176724bf8a5af49e3ca
05c29b1d96008476d28b42a13a4e34e81b628ef4d2bfb203d0075a247bb9431c
aa3e3d48245a2cf65e94a1388666b0741eacfff07847643e116428c10a94b5da
0a03baf24f95b30e16af210ce5f1289680c298b9797ec6abb8f5566c267c2a19
434e8427b603739452b1c7a3eb2f8a4b5014fcbe088bed9d3192c6a7693f7a7e
c3da2f9cdcec67c8bd8024c7f26f03fae9284125f11e795ffbfa8acba16803dc
26b15f744a235ceb9dfb6a6a91d5cb6218b0473bc8ec7028ccf6f2beaac43d48
53ad1aa3ff4f3dcb953f2e7560738f21c8cdadd91a61338e92b50a04943e01d6
a31748dd0aa6f53cbfa189bef070a2304e385ef18c0bab5672e039c4a12c41f7
34c4a0ba138c27572a6c7ef1af7dbdbcface5dcbe246f857e41516b8269b7fca
ec718f7c0b27972083cd3990267d68a2cebd76b6fcaa224c44f3b165d95125f3
bf10aaecc4a9bc8ac2c74f986ba4b3e5bfbb6af841cdae072a3df6234e735e1b
e215d95accde9eb5487f8a6fffb8591b78011cfa38b8a1bb3baa33126eeb4927
bcd4a12bc68a7507953e0adb700395338319b2888482eb6a65355170e029082c
f96b03987d5a39f6d1172f022a2e3bf15a31c18f5b38a5ce77c682c36dd791c9
b75c590c39f53c262df3e923a5766d3885f76841ad8216b99aadad9fac7e4a77
459fa2aa684e309efc142f42c8c0bd6fea3568264d5ba8dc5d773dad44448ca0
cee2f056a2ba2fa8ae563fd35b7e3fdb601c75f16a9dcae0b713cf9dcb705c49
dfb78e200895d26f83fe2213443acc79282987f6f56ef130741b460f07722bda
afed591813af06421614476445cbeb3562cbbf81dfb9abe73f31ffdd4e9a1424
ec8ec8b3234ceeefbf74b2dc4914d5d6f7685655f6f33f2226e2a1d80e7ad488
e04d1a737892c391a5097991fa53cf96910966bccc7844f5438f76cc686f3776
487d7ec49d8c5d8d53914ea9cced3aa35b77006271e5c3006c9cfa4ade6eb755
67fcfb7ee0a0c7105f6247a3ebe4d2a929778963fdbcd7ca5835986fd45b4077
381a973ed8a246d736f14be643616c79e19ea3b32b706ce48148d29492eabb8e
SH256 hash:
fbca0b953516798fdf230b0369f5d19b7111f483aa3895177875750428628969
MD5 hash:
472afcfc669c79a606a8e95732492944
SHA1 hash:
9a4478b681c86dacde3b1e62ef2d111574fe816b
Link:
https://www.unpac.me/results/62a78af0-0985-4b0b-a143-2bbdb088e0c3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fbca0b953516798fdf230b0369f5d19b7111f483aa3895177875750428628969

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe fbca0b953516798fdf230b0369f5d19b7111f483aa3895177875750428628969

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/229218/
  
URLhaus
https://urlhaus.abuse.ch/url/2021570/
  
Delivery method
Distributed via web download

Comments