MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12c2c22ac2896a283118750f17735f30572671bc7400a30368b4e43767d2acd0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12c2c22ac2896a283118750f17735f30572671bc7400a30368b4e43767d2acd0
SHA3-384 hash: 09bffe7818667b782f11c627d8972b82a14f3d5328510e38664654a09fd9a02c0ba296f425c8a5cc4c10e9a983654c3d
SHA1 hash: 7e05be6064bd31477c6eaeddb77cb5e56a980c2d
MD5 hash: 5cb90fba7f11b756b8dca06e51f7a567
humanhash: delaware-hamper-item-single
File name:7e05be6064bd31477c6eaeddb77cb5e56a980c2d.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:1'578'496 bytes
First seen:2025-12-30 12:34:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 87e83bda436138fd7844ecd76decc70d (7 x CoinMiner)
ssdeep 49152:TgqL0h1dNdFKSWa2+g1yv0Mh9owutswgd:/Edt4aoyPjowT
TLSH T12F752395FF4350F0D82706382217F3BE157AF54089368CA6E7D15ACBEC67982288E75B
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10522/11/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter Anonymous
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
_12c2c22ac2896a283118750f17735f30572671bc7400a30368b4e43767d2acd0.exe
Verdict:
No threats detected
Analysis date:
2025-12-30 12:52:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cd4b7642-7856-4c14-9613-8e1f0cc82ebe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46574/
Detection(s):
SecuriteInfo.com.Malware.PDB-473.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6953c7147d915bf1778f00ce
Tags:
ransomware vmprotect coinminer dropper
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm coinminer installer-heuristic mingw packed packed zero zusy
Link:
https://www.filescan.io/uploads/6953c7102fb7bb52ca82164f/reports/c55dab5c-5423-4c9e-82d8-c30fb2e1a47b/overview
Verdict:
Malicious
Labled as:
Trojan.DownLoad3
Link:
https://www.hybrid-analysis.com/sample/12c2c22ac2896a283118750f17735f30572671bc7400a30368b4e43767d2acd0
Verdict:
Adware
File Type:
exe x32
First seen:
2025-12-30T09:34:00Z UTC
Last seen:
2025-12-30T19:30:00Z UTC
Hits:
~10
Detections:
VHO:Trojan.Win32.Miner.gen BSS:Trojan.Win32.Generic not-a-virus:HEUR:RiskTool.Win32.Miner.gen not-a-virus:RiskTool.Win64.Miner.sb
Link:
https://opentip.kaspersky.com/12c2c22ac2896a283118750f17735f30572671bc7400a30368b4e43767d2acd0/results?tab=lookup
Malware family:
PhotoMiner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7b2c8aa8-ffab-4d2c-a163-8938544be836
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/12c2c22ac2896a283118750f17735f30572671bc7400a30368b4e43767d2acd0
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12c2c22ac2896a283118750f17735f30572671bc7400a30368b4e43767d2acd0/
Verdict:
Malicious
Threat:
RiskTool.Win64.Miner
Link:
https://tip.neiki.dev/file/12c2c22ac2896a283118750f17735f30572671bc7400a30368b4e43767d2acd0
Threat name:
Win32.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2025-12-30 12:35:31 UTC
File Type:
PE (Exe)
Extracted files:
20
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=clbmekwcrfvcqmiyouhro427gblsm4n4oqakga3iwtsdoz6svtia._file
Gathering data
Verdict:
Suspicious
Tags:
cryptojacking coinminer
YARA:
CoinMiner_Strings
Link:
https://app.threat.zone/submission/5425acda-7afd-40f8-9fae-6a32dc92b74c
Unpacked files
SH256 hash:
12c2c22ac2896a283118750f17735f30572671bc7400a30368b4e43767d2acd0
MD5 hash:
5cb90fba7f11b756b8dca06e51f7a567
SHA1 hash:
7e05be6064bd31477c6eaeddb77cb5e56a980c2d
Link:
https://www.unpac.me/results/c57a7c3d-9855-4354-bdfd-d826bdcae4a9/
SH256 hash:
037af475fd6f7d1b09152bcad1852f9db1bc479b620046edd860a37f2270fc58
MD5 hash:
33a49d6c07cc1a86e7573b76b6df0890
SHA1 hash:
d06c429e2b5181303760c4b911a55b16513da101
Detections:
INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Link:
https://www.unpac.me/results/c57a7c3d-9855-4354-bdfd-d826bdcae4a9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/12c2c22ac2896a283118750f17735f30572671bc7400a30368b4e43767d2acd0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CoinMiner_Strings
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects mining pool protocol string in Executable
Reference:https://minergate.com/faq/what-pool-address
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/46574/

Comments