# IOC for CoinHelper

Malware analysis and more technical informations at <https://decoded.avast.io/janrubin/toss-a-coin-to-your-helper/>


### Table of Contents
* [Samples (SHA-256)](#samples-sha-256)
* [Network indicators](#network-indicators)
* [Mutexes](#mutexes)


## Samples (SHA-256)
#### CoinHelper binary and related files
```
83a64c598d9a10f3a19eabed41e58f0be407ecbd19bb4c560796a10ec5fccdbf - start.exe
cc36bb34332e2bc505da46ca2f17206a8ae3e4f667d9bdfbc500a09e77bab09c - asacpiex.dll
ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d - CL_Debug_Log.txt
126d8e9e03d7b656290f5f1db42ee776113061dbd308db79c302bc79a5f439d3 - 32.exe
7a3ad620b117b53faa19f395b9532d3db239a1d6b46432033cc0ef6a8d2377cd - 64.exe
7387e57e5ecfdba01f0ad25eeb49abf52fa0b1c66db0b67e382d3b9c057f51a8 - 32.txt
ff5aa6390ed05c887cd2db588a54e6da94351eca6f43a181f1db1f9872242868 - 64.txt
6753d1a408e085e4b6243bfd5e8b44685e8930a81ec27795ccd61f8d54643c4e - amd.txt
93dd8ef915ca39f2a016581d36c0361958d004760a32e9ee62ff5440d1eee494 - nvidia.txt
```


## Network indicators
#### Public IP logging service URL
```
2no[.]co/1wbYc7
```
#### Tor C&Cs
```
bgpaio75egqvqigekt5bqfppzgth72r22f7vhm6xolzqd6ohroxs7pqd[.]onion
jr2jjfxgklthlxh63cz3ajdvh7cj6boz3c3fbhriklk7yip4ce4vzsyd[.]onion
uovyniuak3w4d3yzs4z4hfgx2qa6l2u6cx4wqsje4pmnmygc6vfddwqd[.]onion
rcjndzwubq5zbay5xoqk4dnc23gr4ifseqqsmbw5soogye6yysc7nkyd[.]onion
ist4tvsv5polou6uu5isu6dbn7jirdkcgo3ybjghclpcre5hzonybhad[.]onion
nt4flrgftahnjzrazdstn2uwykuxuclosht46fnbwlcsjj4zaulomlad[.]onion
shmauhvdvfcpkz7gl23kmkep5xtajau3ghxtswur6q5bznnpmfam3iqd[.]onion
sqymp2cgjmp5pllesephn55wtocugudyrxvz2ptkdnctet53e5e4mfid[.]onion
t6ka6jsevtotg4jstanojg3meo24ciyl3fwllzpml4bpibek6waxsgqd[.]onion
7cmqghpupqiquxkfgmotxv6nfl366hyekx4mulez6rdgwdmq7hn72rad[.]onion
bobsslp6f4w23r2g375l6ndbbz7i5uwg7i7j5idieeoqksuwm4wy57yd[.]onion
diyacgq37d4mdev7jao4vjmpplejpx6srnvjspcg7yh4ffdjkiurekyd[.]onion
2qepteituvpy42gggxxqaaeozppjagsu5xz2zdsbugt3425t2mbjvbad[.]onion
r2yzxjp3hrsqjwbpvxsx4zn5ww4cbnt6gqkjkgqrry7634qi7aeqtvyd[.]onion
t7f46q5mj2i7vatj6oij3s4pzr2glxozqzntnq7hab2unh5ph5iniaad[.]onion
vmpzn64y2jg3dtvlg3sdqwngciiqbb53quiw52fjldjrkml5cux4kzad[.]onion
3h7yxuyj6bfgpys63z7gleu6xc3gedgsvzqb2onayv4nvide3cja2vid[.]onion
4sqi3axlh5bxk3jnh76ohvn3nnwekrubdpygznzeqsji7v66secvhgid[.]onion
6yhfokwes7hcjnp7bgzlto5umqcoir7bqfxojd7rsrbnb4cad2uf3dad[.]onion
acis2advyp7ougpe46o64vqwu7qheko3sphytcwsvoyrkysq2r2bt3yd[.]onion
brnrnawg7yv5ot7qc76fqpju6e34dy4z6rbrw3phax6uoyes4vr7sgad[.]onion
unbagbew3rjfng5xtyxtp4oyopcopqwmhargs4m5qz47joisgfyv7wqd[.]onion
xyer2q73qwhc2csqbfzf7w4vv4r6555qhyn6ofm56iwzvkgidxv6coqd[.]onion
jbadd74iobimuuuvsgm5xdshpzk4vxuh35egd7c3ivll3wj5lc6tjxqd[.]onion
```

## Mutexes
```
QPRZ1bWvXh
QPRZ1bWvXh2
QPRZ2bWvXh
QPRZ3bWvXh
```