Skip to content
yararules.org
Menu

YARA · Trellix Advanced Research Center

TRELLIX_ARC_Trojan_Coinminer

Rule to detect Coinminer malware

MalwareCoinminerTrellix Advanced Research CenterApache License 2.0Compiles with YARA-X
Author
Trellix ATR
Date
2021-07-22
Modified
2022-01-19
Score / Quality
75 / 70

What this rule detects

Rule to detect Coinminer malware

Associated malware family: Coinminer.

Targets: Windows PE.

It defines 6 patterns (0 text, 6 hex, 0 regex). YARA modules used: pe.

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

Includes the imports needed to compile it on its own.

trojan-coinminer.yarApache License 2.0
import "pe"

rule TRELLIX_ARC_Trojan_Coinminer : FILE
{
	meta:
		description = "Rule to detect Coinminer malware"
		author = "Trellix ATR"
		id = "ec1f4fb7-bce3-5d5b-bbff-50f9bfc90298"
		date = "2021-07-22"
		modified = "2022-01-19"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/miners/Trojan_CoinMiner.yar#L3-L23"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "3bdac08131ba5138bcb5abaf781d6dc7421272ce926bc37fa27ca3eeddcec3c2"
		hash = "d60766c4e6e77de0818e59f687810f54a4e08505561a6bcc93c4180adb0f67e7"
		logic_hash = "0d9d502eb0a54f90044f42f8ce485a2df6814064172cb7bf006a8c8a51976acd"
		score = 75
		quality = 70
		tags = "FILE"
		version = "v1"

	strings:
		$seq0 = { df 75 ab 7b 80 bf 83 c1 48 b3 18 74 70 01 24 5c }
		$seq1 = { 08 37 4e 6e 0f 50 0b 11 d0 98 0f a8 b8 27 47 4e }
		$seq2 = { bf 17 5a 08 09 ab 80 2f a1 b0 b1 da 47 9f e1 61 }
		$seq3 = { 53 36 34 b2 94 01 cc 05 8c 36 aa 8a 07 ff 06 1f }
		$seq4 = { 25 30 ae c4 44 d1 97 82 a5 06 05 63 07 02 28 3a }
		$seq5 = { 01 69 8e 1c 39 7b 11 56 38 0f 43 c8 5f a8 62 d0 }

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 5000KB and pe.imphash ( ) == "e4290fa6afc89d56616f34ebbd0b1f2c" and 3 of ( $seq* ) )
}

Strings (6 patterns)

IdentifierTypeValueModifiers
$seq0hex{ df 75 ab 7b 80 bf 83 c1 48 b3 18 74 70 01 24 5c }
$seq1hex{ 08 37 4e 6e 0f 50 0b 11 d0 98 0f a8 b8 27 47 4e }
$seq2hex{ bf 17 5a 08 09 ab 80 2f a1 b0 b1 da 47 9f e1 61 }
$seq3hex{ 53 36 34 b2 94 01 cc 05 8c 36 aa 8a 07 ff 06 1f }
$seq4hex{ 25 30 ae c4 44 d1 97 82 a5 06 05 63 07 02 28 3a }
$seq5hex{ 01 69 8e 1c 39 7b 11 56 38 0f 43 c8 5f a8 62 d0 }

Condition

( uint16( 0 ) == 0x5a4d and filesize < 5000KB and pe.imphash ( ) == "e4290fa6afc89d56616f34ebbd0b1f2c" and 3 of ( $seq* ) )

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • The file must be smaller than 5000KB (a cheap guard that skips large files).
  • At least 3 patterns in ( $seq* ) must match.
  • Uses the pe module.
  • Checks the PE import hash (imphash).

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 3bdac08131ba5138bcb5abaf781d6dc7421272ce926bc37fa27ca3eeddcec3c2
  • d60766c4e6e77de0818e59f687810f54a4e08505561a6bcc93c4180adb0f67e7

Licence & attribution

Author: Trellix ATR

Source repository: Trellix Advanced Research Center @ 1919562a59

Licence: Apache License 2.0 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: ec1f4fb7-bce3-5d5b-bbff-50f9bfc90298

Metadata

versionv1

Tags:FILE

Related rules

More Coinminer rules