YARAify Scan Results

Task Information

---

Task ID:	db113f48-8138-11f0-8fb7-42010aa4000b
File name:	28b1a118.exe
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

---

The file matched the following open source and commercial ClamAV rules.

Signature:	Multios.Coinminer.Miner-6781728-2 Alert Create hunting rule

Signature:	Win.Coinminer.Generic-7151250-0 Alert Create hunting rule

Signature:	Win.Coinminer.Generic-7151252-0 Alert Create hunting rule

Signature:	Win.Coinminer.Generic-7151253-0 Alert Create hunting rule

Signature:	Win.Coinminer.Generic-7151447-0 Alert Create hunting rule

Signature:	Win.Coinminer.Generic-7151516-0 Alert Create hunting rule

Signature:	Win.Coinminer.Generic-7152522-0 Alert Create hunting rule

Signature:	Win.Coinminer.Generic-7155777-0 Alert Create hunting rule

Signature:	Win.Coinminer.Generic-7158858-0 Alert Create hunting rule

YARA Results

---

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	CoinMiner_Strings Alert Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects mining pool protocol string in Executable
Reference:	https://minergate.com/faq/what-pool-address
TLP:	TLP:WHITE

Rule name:	CP_AllMal_Detector Alert Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DebuggerCheck__API Alert Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerException__SetConsoleCtrl Alert Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	golang_bin_JCorn_CSC846 Alert Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
Author:	classified
Description:	classified
Reference:	classified
TLP :	TLP:AMBER

Rule name:	MAL_XMR_Miner_May19_1 Alert Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Monero Crypto Coin Miner
Reference:	https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
TLP:	TLP:WHITE

Rule name:	MAL_XMR_Miner_May19_1_RID2E1B Alert Create hunting rule
Author:	Florian Roth
Description:	Detects Monero Crypto Coin Miner
Reference:	https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
TLP:	TLP:WHITE

Rule name:	MINER_monero_mining_detection Alert Create hunting rule
Author:	Trellix ATR team
Description:	Monero mining software
TLP:	TLP:WHITE
Repository:	advanced-threat-research

Rule name:	pe_detect_tls_callbacks Alert Create hunting rule
Author:
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	PUA_Crypto_Mining_CommandLine_Indicators_Oct21 Alert Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects command line parameters often used by crypto mining software
Reference:	https://www.poolwatch.io/coin/monero
TLP:	TLP:WHITE

Rule name:	PUA_WIN_XMRIG_CryptoCoin_Miner_Dec20 Alert Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects XMRIG crypto coin miners
Reference:	https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	PUA_WIN_XMRIG_CryptoCoin_Miner_Dec20_RID33BA Alert Create hunting rule
Author:	Florian Roth
Description:	Detects XMRIG crypto coin miners
Reference:	https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/
TLP:	TLP:WHITE

Rule name:	SEH__vectored Alert Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	SUSP_XMRIG_String Alert Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious XMRIG crypto miner executable string in filr
Reference:	Internal Research
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SUSP_XMRIG_String_RID2D18 Alert Create hunting rule
Author:	Florian Roth
Description:	Detects a suspicious XMRIG crypto miner executable string in filr
Reference:	Internal Research
TLP:	TLP:WHITE

Rule name:	ThreadControl__Context Alert Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	XMRIG_Monero_Miner Alert Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Monero mining software
Reference:	https://github.com/xmrig/xmrig/releases
TLP:	TLP:WHITE

Rule name:	XMRIG_Monero_Miner_RID2DC1 Alert Create hunting rule
Author:	Florian Roth
Description:	Detects Monero mining software
Reference:	https://github.com/xmrig/xmrig/releases
TLP:	TLP:WHITE

Rule name:	xmrig_v1 Alert Create hunting rule
Author:	RandomMalware
TLP:	TLP:WHITE
Repository:	YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Unpacked Files

---

The following files could be unpacked from this sample.