MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc739b3b8bd5157690d248132ee974ad3d62292959d99cc68c44b2d61cb3907d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 8

Intelligence 8 IOCs YARA 4 File information Comments

SHA256 hash:	fc739b3b8bd5157690d248132ee974ad3d62292959d99cc68c44b2d61cb3907d
SHA3-384 hash:	d5533d24e885f3408264324a8f321fc5e004558e54697a7712e9f533669b951d0874f863cde6e904406619d0a2cc38b4
SHA1 hash:	6b72720b84ec835b463b6d602fda933d1f4e6c47
MD5 hash:	c13e76853e36a6a14d11ed009e3b765e
humanhash:	batman-april-maryland-video
File name:	SecuriteInfo.com.ArtemisC13E76853E36.25435.8390
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	3'289'032 bytes
First seen:	2022-03-23 09:13:43 UTC
Last seen:	2022-03-25 06:58:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	4e4095a0d90406c8428c5d9a9c6b05b7 (26 x CoinMiner, 4 x CoinMiner.XMRig)
ssdeep	49152:WC2OPGTxitRlaAR/3AW8hIhr+sOIktcr5HLOrhqwIKyJbMGnaDeqrTmHReQSA0NJ:WpOPG4CA1oSgzIYcVHLE4wVwG4j
TLSH	T120E501FC61443758C02BCD794523EE06B2B55A2E07F9A9FAB8DE76803FAF4449912F11
Reporter	SecuriteInfoCom
Tags:	CoinMiner exe

Intelligence

File Origin

# of uploads :

# of downloads :

201

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/255889/

Detection(s):

SecuriteInfo.com.ArtemisC13E76853E36.25435.8390.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% subdirectories

Launching the default Windows debugger (dwwin.exe)

Sending a custom TCP request

Searching for the window

Blocking the Windows Defender launch

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Sending an HTTP GET request to an infection source

Result

Malware family:

n/a

Score:

0/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/10770/overview

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/623ae503b94fb38cb4d7f5b5/reports/8135add1-a333-4b44-8742-7c5518af29af/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Gathering data

Result

Threat name:

Phoenix Miner Xmrig

Detection:

malicious

Classification:

evad.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/962705

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fc739b3b8bd5157690d248132ee974ad3d62292959d99cc68c44b2d61cb3907d/

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2022-03-22 10:00:00 UTC

File Type:

PE+ (Exe)

AV detection:

24 of 42 (57.14%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7rzzwo4l2ukxnegsjajs52luvu6wekjjlhmzzrumisznmhftsb6q._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

10/10

Tags:

evasion persistence trojan

Link:

https://tria.ge/reports/220323-k7jv4afgbk/

Behaviour

Adds Run key to start application

Modifies Windows Defender Real-time Protection settings

Unpacked files

SH256 hash:

fc739b3b8bd5157690d248132ee974ad3d62292959d99cc68c44b2d61cb3907d

MD5 hash:

c13e76853e36a6a14d11ed009e3b765e

SHA1 hash:

6b72720b84ec835b463b6d602fda933d1f4e6c47

Link:

https://www.unpac.me/results/c3625fde-0974-4ec1-a298-d0120df68a1b/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/fc739b3b8bd5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/fc739b3b8bd5157690d248132ee974ad3d62292959d99cc68c44b2d61cb3907d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MALWARE_Win_CoinMiner02 Create hunting rule
Author:	ditekSHen
Description:	Detects coinmining malware

Rule name:	MAL_XMR_Miner_May19_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Monero Crypto Coin Miner
Reference:	https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

Rule name:	MAL_XMR_Miner_May19_1_RID2E1B Create hunting rule
Author:	Florian Roth
Description:	Detects Monero Crypto Coin Miner
Reference:	https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

Rule name:	rig_win64_xmrig_6_13_1_xmrig Create hunting rule
Author:	yarGen Rule Generator
Description:	rig_win64 - file xmrig.exe
Reference:	https://github.com/Neo23x0/yarGen