MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0de787cffbec4dcc42e0ecd9491795c7dfe8fe4a955cb67a87544d5c36070982. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 8

Intelligence 8 IOCs YARA 9 File information Comments 2

SHA256 hash:	0de787cffbec4dcc42e0ecd9491795c7dfe8fe4a955cb67a87544d5c36070982
SHA3-384 hash:	e4529ef82ee2b94f48c6d4e3dbab5ba10e7c36eb54380359f7207d55e5da9724419eaafd993c75362f467d5c4572f338
SHA1 hash:	c9406ef348433c57663bb8c0cf734c00c0e71110
MD5 hash:	c492c1c77f913c5e7f54941f1c625db9
humanhash:	don-nine-massachusetts-leopard
File name:	0de787cffbec4dcc42e0ecd9491795c7dfe8fe4a955cb67a87544d5c36070982
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	3'145'728 bytes
First seen:	2026-10-25 03:00:34 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	49152:MOpFRF8oFPvnl50p+0eVlvviccJ1TbXLP9TIy2o162i22mG2zs72gta:FprnVnq+Zvqz1vL9TWo16X22j2
TLSH	T19FE5CF1BB59250FDC1E6C070839B9673AA31B85552307E7F62C4AF312F26F20676EB61
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	c2hunter
Tags:	CoinMiner elf wraith

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/a597eee5-1084-44e9-b969-930ce622f080/

Result

Verdict:

Malware

Maliciousness:

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

base64 fingerprint golang packed upx

Link:

https://www.filescan.io/uploads/6add71089e58184bb3d53232/reports/90be8530-08fa-4824-841e-7ca74edad7f2/overview

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

custom

Botnet:

unknown

Number of open files:

Number of processes launched:

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/0de787cffbec4dcc42e0ecd9491795c7dfe8fe4a955cb67a87544d5c36070982

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/66c923a6-bea6-494e-acc2-0f38804c3b59

Behavior Graph:

Download SVG

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/f64ab839-2894-41d2-b2b5-a7e2502786f8

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/0de787cffbec4dcc42e0ecd9491795c7dfe8fe4a955cb67a87544d5c36070982

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0de787cffbec4dcc42e0ecd9491795c7dfe8fe4a955cb67a87544d5c36070982/

Threat name:

Linux.Trojan.Generic

Status:

Suspicious

First seen:

2026-10-25 03:01:39 UTC

File Type:

ELF64 Little (Exe)

AV detection:

8 of 36 (22.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bxtypt735rg4yqxa5tmusf4vy7p6r7sksvolm6uhkrgvynqhbgba._file

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig linux miner upx

Link:

https://tria.ge/reports/261025-dh42eadx5t/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/0de787cffbec4dcc42e0ecd9491795c7dfe8fe4a955cb67a87544d5c36070982

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ELF_IoT_DVR_Botnet_Hama_UPX Create hunting rule
Author:	Serhii Kocherhan
Description:	Detects packed and unpacked ELF IoT/DVR botnet variants targeting UPX compression structures and uncompressed code

Rule name:	enterpriseapps2 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Enterprise apps

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	miner_lin_xmrig_strings Create hunting rule
Author:	Sekoia.io
Description:	Detects XMRig ELF

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/

Rule name:	unixredflags3 Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Hunts for UNIX red flags

Rule name:	upx_packed_elf_v1 Create hunting rule
Author:	RandomMalware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

Dense commented on 2026-10-25 08:30:11 UTC

Follow-up to the earlier structural review: a complete original is now present in a subsequent local Cowrie archive. Full SHA-256 a151d3f4f2422531f30a843ffb35479596c86722bb103bdf8591105687f9b125 is 3,373,344 bytes; its first 3,145,728 bytes reproduce this record SHA-256 and match every byte of the preserved partial file. This resolves the earlier missing-full-parent limitation. The same full file also reproduces the first-2,129,920-byte record 5efc93a8488495931f5b0eda5413a23077808fdcc676903055901be64ff22024. The original section-table and load-segment truncation findings for this hash remain valid; locating the complete parent does not make this partial file executable or a separate working variant. The complete parent was already indexed as CoinMiner in September; retain its historical dates. No repaired executable or new file upload, execution or endpoint contact.

Dense commented on 2026-10-25 05:29:25 UTC

Structural review and submission hold, 2026-10-25 UTC. SHA-256 verified; the file is exactly 3,145,728 bytes. Its ELF64 section table starts at 3,372,256 and ends at 3,373,344, beyond captured EOF. Both PT_LOAD segments also require absent bytes: first segment ends at 3,325,013; second begins at 3,326,464 and ends at 3,372,080. This is not merely a stripped section table: executable/loadable content is missing. Strings contain XMRig-related markers and public IP-discovery services, but those do not independently prove malware-family attribution or malicious infrastructure. No full exact-prefix parent was found in the reviewed local archive. Preserve this hash as incomplete capture evidence and hold it from automatic re-upload; do not silently reconstruct it or count it as a verified working Wraith variant. No repaired executable, execution, unpacker emulation or endpoint contact.