MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ebcfddad6ca2b49edfeacdfb3e9f074333729b965d637aa44ecb8df3626efe9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ebcfddad6ca2b49edfeacdfb3e9f074333729b965d637aa44ecb8df3626efe9
SHA3-384 hash: 075c32de78b96bffde8d29214798edd264886f8f88c35efe510db1d2094020f0ea0dffd8d7a35e6e5bce340f6abf33c4
SHA1 hash: 858d8b4a31fa746a85c9c8336d59bd5a550a8086
MD5 hash: ab943920f96a90e50a368e128a8717ce
humanhash: xray-sad-robert-tango
File name:file
Download: download sample
Signature CoinMiner
Create hunting rule
File size:3'436'344 bytes
First seen:2025-12-03 13:22:00 UTC
Last seen:2025-12-03 13:51:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3641b918fa6fcd6b6754b75fd2065c00 (5 x CoinMiner)
ssdeep 98304:qGOpZ5mFCugjTYsy5TVG9KkZ3L3e0gsp+e:qEsy5TVG4gX
Threatray 57 similar samples on MalwareBazaar
TLSH T1DAF533AC5C6110F0DB3E8E39C3A3EB24993F75598B52ADDF067432554A227D3BE2681C
TrID 73.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
8.9% (.EXE) OS/2 Executable (generic) (2029/13)
8.8% (.EXE) Generic Win/DOS Executable (2002/3)
8.8% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:CoinMiner dropped-by-amadey exe fbf543


Avatar
Bitsight
url: http://216.126.239.11/alfa.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
73
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
xmrig
Create hunting rule
ID:
1
File name:
_1ebcfddad6ca2b49edfeacdfb3e9f074333729b965d637aa44ecb8df3626efe9.exe
Verdict:
Malicious activity
Analysis date:
2025-12-03 13:24:30 UTC
Tags:
pastebin miner winring0-sys vuln-driver upx xmrig
Link:
https://app.any.run/tasks/30a732ef-598e-411c-a0b1-c31ab3ddc9e1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CoinMiner
Create hunting rule
Link:
https://www.capesandbox.com/analysis/42278/
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6930398b16e6db515e464353
Tags:
injection obfusc crypt
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug expired-cert invalid-signature krypt signed
Link:
https://www.filescan.io/uploads/69303988979e53a83592f0f9/reports/86fc8a3e-6850-4919-9c18-54123c567fd3/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/1ebcfddad6ca2b49edfeacdfb3e9f074333729b965d637aa44ecb8df3626efe9
Result
Gathering data
Verdict:
Malicious
File Type:
exe x64
Detections:
Trojan.Win32.Miner.sb Trojan.Win32.Agent.rnd
Link:
https://opentip.kaspersky.com/1ebcfddad6ca2b49edfeacdfb3e9f074333729b965d637aa44ecb8df3626efe9/results?tab=lookup
Malware family:
XMRig Miner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c0824b1d-b3d3-4884-b1a8-f2195c43d243
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1ebcfddad6ca2b49edfeacdfb3e9f074333729b965d637aa44ecb8df3626efe9
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ebcfddad6ca2b49edfeacdfb3e9f074333729b965d637aa44ecb8df3626efe9/
Verdict:
Malicious
Threat:
Family.XMRIG
Link:
https://tip.neiki.dev/file/1ebcfddad6ca2b49edfeacdfb3e9f074333729b965d637aa44ecb8df3626efe9
Threat name:
Win64.Trojan.MintZard
Create hunting rule
Status:
Malicious
First seen:
2025-12-03 13:22:18 UTC
File Type:
PE+ (Exe)
AV detection:
24 of 36 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d26p3wwwzivut3p6vtp3h2pqoqztoknzmxldpkse5s4n6nrg57uq._file
Verdict:
malicious
Label(s):
xmrig
Create hunting rule
Similar samples:
1ebcfddad6ca2b49edfeacdfb3e9f074333729b965d637aa44ecb8df3626efe9
CoinMiner
47d57b7dc72f31edd3b52e8c78b7fe0846d7ed8114f8ab98b9a1f5d8e8e89bd2
CoinMiner
8832f5ecb1e61c79555bb01ba4b0567c3293400b64deb504349fde67d2c5f6d2
CoinMiner
984dbd06c3a8ece43142e45d61b2aa3dfae7be270edc66153dc8d521f481d1ef
CoinMiner
c28c65b7f30c1ed7af879a7aa2b6aa8b1f8e54775ed847d0655a8d7bb2f939c7
CoinMiner
d335a352595cd376587cc3e071b6fdaa58b1e8f5e193f090d679e36cda054b66
CoinMiner
e48fb8537dae0ddc883d3b19f13211bdcc4f506ce002b99a02241d9febc8f5d0
CoinMiner
error
CoinMiner
fb710f58f94eba2aaf7e08c8244c7db62b54846c1172ae2c67d5d3c136b011f7
CoinMiner
+ 47 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig defense_evasion execution miner persistence upx
Link:
https://tria.ge/reports/251203-qmb8ea1jdn/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
UPX packed file
Legitimate hosting services abused for malware hosting/C2
Creates new service(s)
Cryptocurrency Miner
Executes dropped EXE
Stops running service(s)
Command and Scripting Interpreter: PowerShell
XMRig Miner payload
Xmrig family
xmrig
Unpacked files
SH256 hash:
1ebcfddad6ca2b49edfeacdfb3e9f074333729b965d637aa44ecb8df3626efe9
MD5 hash:
ab943920f96a90e50a368e128a8717ce
SHA1 hash:
858d8b4a31fa746a85c9c8336d59bd5a550a8086
Link:
https://www.unpac.me/results/35ed24ea-965e-4ddf-8dbc-59ca13c7dc97/
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1ebcfddad6ca/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Windows_Generic_Threat_e8abb835
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 1ebcfddad6ca2b49edfeacdfb3e9f074333729b965d637aa44ecb8df3626efe9

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3724175/
Cape
Cape
https://www.capesandbox.com/analysis/42278/

Comments