🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18a6ab8bab49ab74041d2a61fcebf9a8e0576dde28ff04420f6a9b1bdaeccd58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18a6ab8bab49ab74041d2a61fcebf9a8e0576dde28ff04420f6a9b1bdaeccd58
SHA3-384 hash: 065cef506532921962ee36b6c8cb3ee4fe51853a7532d229c037babe8596439659520c1616fccd1e67c3b8e4a95b5e0f
SHA1 hash: 072443001d8a41dc3882ac1847b0741050796380
MD5 hash: 03321ba90bef15d389151a53fec8109f
humanhash: oklahoma-berlin-muppet-fish
File name:file
Download: download sample
Signature CoinMiner
Create hunting rule
File size:12'288 bytes
First seen:2026-03-08 19:00:38 UTC
Last seen:2026-03-09 08:29:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 059ef2ae60d092146585018c0d07841e (1 x CoinMiner)
ssdeep 192:PNATKlXO8PYYleg7zvy7tXpyMJxTZ3lkWScthBsufT:Fi4XYY0AYVZKWScBPT
Threatray 99 similar samples on MalwareBazaar
TLSH T18C4218076D964131FBE40CB1197A424B86BD3DA23BC1E89FB740F94A2DB2760C47563E
TrID 39.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
21.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
8.3% (.EXE) Win64 Executable (generic) (6522/11/2)
6.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter Bitsight
Tags:CoinMiner dropped-by-phorpiex exe


Avatar
Bitsight
url: http://178.16.54.109/xmrget.exe

Intelligence

File Origin
# of uploads :
28
# of downloads :
227
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Malware family:
xmrig
Create hunting rule
ID:
1
File name:
_18a6ab8bab49ab74041d2a61fcebf9a8e0576dde28ff04420f6a9b1bdaeccd58.exe
Verdict:
Malicious activity
Analysis date:
2026-03-08 19:01:26 UTC
Tags:
miner xmrig loader auto-reg
Link:
https://app.any.run/tasks/8e2f6baf-d1f4-434f-90f6-b4354360cc16

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/56679/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.49778932.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69adc77fe5dc8e2b2c3126aa
Tags:
downloader dropper xmrig sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm cmd lolbin microsoft_visual_cc packed phorpiex
Link:
https://www.filescan.io/uploads/69adc77c97feb4afd6756459/reports/99b0b0e7-26c7-4e2e-bad5-269f81fd39c6/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/18a6ab8bab49ab74041d2a61fcebf9a8e0576dde28ff04420f6a9b1bdaeccd58
Verdict:
Malicious
File Type:
exe x32
Detections:
Trojan.Win32.Zonidel.sb Backdoor.Win32.Zegost.sb HEUR:Trojan.Win32.Miner.gen BSS:Trojan.Win32.Generic Trojan.Win32.Agent.sb Trojan-Downloader.Tiny.HTTP.Download Trojan-Downloader.Bitmin.TCP.C&C not-a-virus:RiskTool.Win64.XMRigMiner.a not-a-virus:VHO:RiskTool.Win32.BitCoinMiner.gen not-a-virus:BSS:RiskTool.Win32.BitCoinMiner.ga not-a-virus:HEUR:RiskTool.Win32.BitMiner.gen RiskTool.BitCoinMiner.TCP.C&C not-a-virus:RiskTool.Win32.BitCoinMiner.sb HEUR:Trojan-Downloader.Win32.Bitmin.gen
Link:
https://opentip.kaspersky.com/18a6ab8bab49ab74041d2a61fcebf9a8e0576dde28ff04420f6a9b1bdaeccd58/results?tab=lookup
Malware family:
Phorpiex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f37649f3-9121-4e80-8351-4df04c754eab
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/18a6ab8bab49ab74041d2a61fcebf9a8e0576dde28ff04420f6a9b1bdaeccd58
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/03321ba90bef15d389151a53fec8109f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18a6ab8bab49ab74041d2a61fcebf9a8e0576dde28ff04420f6a9b1bdaeccd58/
Verdict:
Malicious
Threat:
Family.XMRIG
Link:
https://tip.neiki.dev/file/18a6ab8bab49ab74041d2a61fcebf9a8e0576dde28ff04420f6a9b1bdaeccd58
Threat name:
Win32.Worm.Phorpiex
Create hunting rule
Status:
Suspicious
First seen:
2026-03-08 18:40:12 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dctkxc5ljgvxiba5fjq7z27zvdqfo3o6fd7qiqqpnknrxwxmzvma._file
Verdict:
malicious
Label(s):
xmrig
Create hunting rule
phorpiex
Create hunting rule
Similar samples:
0d1ffcadc3b75c99807be361c95c9742377ec7aec19e25d2e88225e75dfbd082
CoinMiner
4e160339aeb9bfbd576dfbe288cbb58eb82b7d85f9c4d84651cb1ee024c3a260
CoinMiner
63aa8da1aedb07d075c13f700877a7525df5b4f434c5f24026a77365517cb225
CoinMiner
67ef7c95ecddd6f385897cd6c12e0017a1ea8e538009607251d5de8b7839a07d
CoinMiner
7a1e4f70eee2e623e59867467b1e9174faec5731d6e598a921f838d97f31677e
CoinMiner
ce49befb88317c929087b48a7a965f24b56712d8ca19ffffb620fe799806f2cf
CoinMiner
error
CoinMiner
+ 89 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig discovery miner persistence
Link:
https://tria.ge/reports/260308-xpbszsg15l/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Downloads MZ/PE file
XMRig Miner payload
Xmrig family
xmrig
Unpacked files
SH256 hash:
18a6ab8bab49ab74041d2a61fcebf9a8e0576dde28ff04420f6a9b1bdaeccd58
MD5 hash:
03321ba90bef15d389151a53fec8109f
SHA1 hash:
072443001d8a41dc3882ac1847b0741050796380
Link:
https://www.unpac.me/results/7c5de77a-b45c-4080-b036-9cccce94bab5/
Malware family:
Phorpiex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/18a6ab8bab49/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/18a6ab8bab49ab74041d2a61fcebf9a8e0576dde28ff04420f6a9b1bdaeccd58

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 18a6ab8bab49ab74041d2a61fcebf9a8e0576dde28ff04420f6a9b1bdaeccd58

(this sample)

  
Dropped by
Phorpiex
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3792474/
Cape
Cape
https://www.capesandbox.com/analysis/56679/

Comments