MALICIOUS — 885b2cc83a6676664b030d72a84c462ea5bcfeaf40c78bade97c8bd31c6235a3
MALICIOUS — 885b2cc83a6676664b030d72a84c462ea5bcfeaf40c78bade97c8bd31c6235a3 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the CoinHive family. 4 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
885b2cc83a6676664b030d72a84c462ea5bcfeaf40c78bade97c8bd31c6235a3 - SHA-1:
d7bf5fb9caf4b85928bad3a9203ef7db4e79274a - MD5:
61f0024372f1dde771018d8d6424d681 - ssdeep:
768:SeP+yUbVLS6dpBagHwzT4ynv9kQmay5RKMFiHKautB1apQY:v+HbVLSmpBaGtynv9T7GKxqautB10 - TLSH:
T1E22FE6293EA73AC606E48957256DC7D0C0C5C697E53383A6E972FF48ED38D30584889B - Submitted as: 885b2cc83a6676664b030d72a84c462ea5bcfeaf40c78bade97c8bd31c6235a3
- File type: html · Size: 35578 bytes
- Verdict: malicious (99/100) · Family: CoinHive
Detections (4 of 51 engines)
- ClamAV (daily): Js.Coinminer.Generic-6836639-1
- Microsoft Defender: Trojan:JS/CoinHive.B
- Emsisoft (Emergency Kit): GT:JS.Application.CoinHive.1.A6D67ABD
- Kaspersky (KVRT): HEUR:Trojan.JS.Miner.gen
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Js.Coinminer.Generic-6836639-1 (rule
Js.Coinminer.Generic-6836639-1) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7348) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Trojan:JS/CoinHive.B (rule
Trojan:JS/CoinHive.B) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged GT:JS.Application.CoinHive.1.A6D67ABD (rule
GT:JS.Application.CoinHive.1.A6D67ABD) - engine signal, weight 0.55, confidence 0.85 - Obfuscated javascript script: dynamic-exec (layers: concat) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://laschicasmassexisfotos.blogspot.com/favicon.ico, http://laschicasmassexisfotos.blogspot.com/search/label/semanal - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
274 behavior events · 1 ATT&CK techniques · 1 dropped files.
Runtime network
- searchapp.bundleassets.example
- www.msftconnecttest.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- www.bing.com
- config.edge.skype.com
- desktop-hsgcbep
- aps.prod.windows.com
- tas02.sls.update.microsoft.com
- to-do.microsoft.com
- dns.msftncsi.com
- settings-win.data.microsoft.com
- ctldl.windowsupdate.com
- staging.to-do.microsoft.com
- edge.microsoft.com
- teams.microsoft.com
- g.live.com
- ecs.office.com
- watson.events.data.microsoft.com
Dropped files
- c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315 -
c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315
Embedded URLs
- http://www.w3.org/1999/xhtml
- http://www.google.com/2005/gml/b
- http://www.google.com/2005/gml/data
- http://www.google.com/2005/gml/expr
- https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
- http://laschicasmassexisfotos.blogspot.com/favicon.ico
- http://laschicasmassexisfotos.blogspot.com/search/label/semanal
- http://laschicasmassexisfotos.blogspot.com/feeds/posts/default
- http://laschicasmassexisfotos.blogspot.com/feeds/posts/default?alt=rss
- https://www.blogger.com/feeds/3161026573826376422/posts/default
- https://coinhive.com/lib/coinhive.min.js
- https://www.blogger.com/dyn-css/authorization.css?targetBlogID=3161026573826376422&
- https://apis.google.com/js/plusone.js
- http://laschicasmassexisfotos.blogspot.com/
- http://laschicasmassexisfotos.blogspot.com/2011/01/tias-en-bikini-top-model-enero-2009.html
- http://laschicasmassexisfotos.blogspot.com/search/label/chicas%20bonitas%20videos
- http://laschicasmassexisfotos.blogspot.com/search/label/sensuales
- http://laschicasmassexisfotos.blogspot.com/2011/01/tias-en-bikini-top-model-enero-2009.html#comment-form
- http://7bb09029p8luergdlanan7gx23.hop.clickbank.net/?tid=BLOGGER
- http://sistemadelmachoalfa.com/banner336x280a.gif
- http://2.bp.blogspot.com/_81QR_tSPgPE/SWelduzSW7I/AAAAAAAANuQ/fVCQsd45-gU/s1600-h/mg_june_2008_02.jpg
- http://2.bp.blogspot.com/_81QR_tSPgPE/SWelduzSW7I/AAAAAAAANuQ/fVCQsd45-gU/s400/mg_june_2008_02.jpg
- http://4.bp.blogspot.com/_81QR_tSPgPE/SWeldAPa4PI/AAAAAAAANuI/GbF5mqH981g/s1600-h/andreagarcia6.jpg
- http://4.bp.blogspot.com/_81QR_tSPgPE/SWeldAPa4PI/AAAAAAAANuI/GbF5mqH981g/s400/andreagarcia6.jpg
- http://2.bp.blogspot.com/_81QR_tSPgPE/SWelc7Bt9NI/AAAAAAAANuA/gEIkToEaq4E/s1600-h/andreagarcia5.jpg
Embedded domains
- www.w3.org
- www.google.com
- www.blogger.com
- laschicasmassexisfotos.blogspot.com
- www.quickonlinetips.com
- www.chicablogger.com
- coinhive.com
- blogspot.com
- apis.google.com
- pagead2.googlesyndication.com
- 7bb09029p8luergdlanan7gx23.hop.clickbank.net
- sistemadelmachoalfa.com
- 2.bp.blogspot.com
- 4.bp.blogspot.com
- blogger.googleusercontent.com
- www.feedburner.com
- gananciasconadsense.com
- resources.infolinks.com
- 1.bp.blogspot.com
- 3.bp.blogspot.com
- twitter.com
- delicious.com
- www.facebook.com
- www.wikio.es
- meneame.net
More CoinHive samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report