jaffacakes118_Trojan[.]Win32[.]CoinMiner[.]pve[.]643d9e99ec8791ee347962f75accf9ae

General

Target
jaffacakes118_Trojan.Win32.CoinMiner.pve.643d9e99ec8791ee347962f75accf9ae
Size 565KB
Sample261018-3ynrssvs4p
SHA256 0d3fa0256271ba370611b27cb2bef78be7737f1734e71c49d67a5800be860045
MD5 643d9e99ec8791ee347962f75accf9ae
SHA1 6b145713f10a89c89e3e911174f29aa4cd7ca940
SHA512 9837374fd325783167123eec0dc3c091c14cb1d0a6ff2d3df7206d715b4316e59736f60bd2d5f8e912a0ad477c5308e1545d7b29ac17c38b824bb2a056370d82
SSDEEP 12288:yVqzf2ZTxK70RmIbO5j1I2zp2Y5+qHUSTl:yEzcI0EIEHDwoUSTl
TLSH
T1D3C4232FF9FB1D25CE46D0398DA4304C6A77132ACC205D673A5D489DAA7170B8FA44EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/st_42016.exe

File Explorer

jaffacakes118_Trojan.Win32.CoinMiner.pve.643d9e99ec8791ee347962f75accf9ae

.zip 565KB
st_42016.exe

.exe 1.0MB

jaffacakes118_Trojan.Win32.CoinMiner.pve.643d9e99ec8791ee347962f75accf9ae

SHA256 0d3fa0256271ba370611b27cb2bef78be7737f1734e71c49d67a5800be860045
MD5 643d9e99ec8791ee347962f75accf9ae
SHA1 6b145713f10a89c89e3e911174f29aa4cd7ca940
SHA512 9837374fd325783167123eec0dc3c091c14cb1d0a6ff2d3df7206d715b4316e59736f60bd2d5f8e912a0ad477c5308e1545d7b29ac17c38b824bb2a056370d82
SSDEEP 12288:yVqzf2ZTxK70RmIbO5j1I2zp2Y5+qHUSTl:yEzcI0EIEHDwoUSTl
TLSH
T1D3C4232FF9FB1D25CE46D0398DA4304C6A77132ACC205D673A5D489DAA7170B8FA44EB
MD5 SHA1 SHA512 SSDEEP TLSH

st_42016.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 eca9ff63b1bb809b65e71cb06854c3f7bba4d0ff0825c9a0e5fbd7a3027ff7d2
MD5 86557290c440c4a1d84cb103c9735cd0
SHA1 f7190ec67d9629464b77cf64f42efee0ae69d6d9
SHA512 fc2873aa9b81f1fbb1a1f199a85f81081d6c0a6a66e8f80f585cb24650392095146a46ae27265f8c78220948f4ead7da15a611b1ea437f4d2121a18461d9960a
SSDEEP 24576:4CCks4ECO8zfeJ3rnI/A93F9GSlgt5rnkyfJy3wb55:JCkzlfeJ3rnIo97GMgt5rnkys3wbj
TLSH
T191259F2177F6C0BED2A211318A1DBBF591FAE7090B2548C36780CE1D6F359D2D63AA4D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1056794

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Developer\Documents\Visual Studio 2017\Projects\CLI-CSharp.NET.2.0\CLI-Setup-CSharp\obj\Release\CLI-Setup-CSharp.pdb

jaffacakes118_Trojan.Win32.CoinMiner.pve.643d9e99ec8791ee347962f75accf9ae

st_42016.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.CoinMiner.pve.643d9e99ec8791ee347962f75accf9ae

st_42016.exe

mscoree

dotnet