MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 237e6ff6b83166d19edabf4cade3cec3ceb4b9665b70c52d4b0e79b9670d8846. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 16

Intelligence 16 IOCs YARA 8 File information Comments

SHA256 hash:	237e6ff6b83166d19edabf4cade3cec3ceb4b9665b70c52d4b0e79b9670d8846
SHA3-384 hash:	b4fd7c7d636b87fff7bef32320c6322ab380d80d255a4b06839499eb6b3d0d27d1fd6eb642b022b7b6e059d4b68db078
SHA1 hash:	5339fcfe4e1059f3b0207de13fdf72b0774eeca7
MD5 hash:	5ea04d9d8865d5089af3ce6dbc7daa73
humanhash:	wyoming-white-iowa-carolina
File name:	SecuriteInfo.com.Heur.Mint.Phil.57.53113593
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	2'721'792 bytes
First seen:	2026-06-19 10:28:57 UTC
Last seen:	2026-06-23 21:10:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	088677779e5c66c1ad4fb67f6207c321 (1 x CoinMiner)
ssdeep	49152:oqwiBoa9cQKzGCh3buPMbh3Fr7fSvU1u0M2N6lyyOn0ACw5lBYtJHQdN8AF3/5:h6a9cQKzGCZqPMbhVfNuPxO0AC6Qtg6E
TLSH	T149C523A3FA446DF9E126C435474581732872B48A0B39B3FF179402306E79AFB6F68719
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	CoinMiner exe

Intelligence

File Origin

# of uploads :

# of downloads :

139

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

xmrig

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-06-19 10:34:05 UTC

Tags:

telegram ip-check evasion winring0-sys vuln-driver auto-reg miner xmrig rust

Link:

https://app.any.run/tasks/1bd2c4de-64b7-4197-8587-00d1c4e7a48f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

CoinMiner

Link:

https://www.capesandbox.com/analysis/71225/

Detection(s):

SecuriteInfo.com.Heur.Mint.Phil.57.53113593.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a351a0586bc95245bf7be07

Tags:

ransomware coinminer xmrig crypt

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file

Creating a service

Launching a service

Loading a system driver

Deleting a recently created file

Creating a file in the system32 directory

Enabling the 'hidden' option for recently created files

DNS request

Connection attempt

Sending an HTTP GET request

Creating a process from a recently created file

Creating a window

Running batch commands

Сreating synchronization primitives

Launching a process

Searching for synchronization primitives

Connecting to a cryptocurrency mining pool

Sending a custom TCP request

Enabling autorun for a service

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm cmd lolbin packed rust

Link:

https://www.filescan.io/uploads/6a351a0290632a45f72c6882/reports/486a1e50-f4e6-495f-acd6-5b6d27adddf7/overview

Verdict:

Malicious

Labled as:

Mint.Phil.Generic

Link:

https://www.hybrid-analysis.com/sample/237e6ff6b83166d19edabf4cade3cec3ceb4b9665b70c52d4b0e79b9670d8846

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-06-17T16:45:00Z UTC

Last seen:

2026-06-20T23:41:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/237e6ff6b83166d19edabf4cade3cec3ceb4b9665b70c52d4b0e79b9670d8846/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/895c076b-b613-49bc-b56b-c3d256f644cf

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/237e6ff6b83166d19edabf4cade3cec3ceb4b9665b70c52d4b0e79b9670d8846

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/237e6ff6b83166d19edabf4cade3cec3ceb4b9665b70c52d4b0e79b9670d8846/

Threat name:

Win64.Trojan.MintPhil

Status:

Malicious

First seen:

2026-06-17 22:12:59 UTC

File Type:

PE+ (Exe)

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=en7g75vygftndhw2x5gk3y6oyphljolglnymklklbz43szynrbda._file

Verdict:

malicious

Label(s):

xmrig

Similar samples:

error

CoinMiner

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig defense_evasion discovery miner persistence privilege_escalation trojan

Link:

https://tria.ge/reports/260619-mjacvsgx6t/

Behaviour

Checks processor information in registry

Modifies registry class

NTFS ADS

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

System Network Configuration Discovery: Internet Connection Discovery

Drops file in System32 directory

Adds Run key to start application

Drops desktop.ini file(s)

Looks up external IP address via web service

Cryptocurrency Miner

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Registers new Windows logon scripts automatically executed at logon.

Windows security modification

XMRig Miner payload

Family: xmrig

Modifies WinLogon for persistence

Windows security bypass

Unpacked files

SH256 hash:

237e6ff6b83166d19edabf4cade3cec3ceb4b9665b70c52d4b0e79b9670d8846

MD5 hash:

5ea04d9d8865d5089af3ce6dbc7daa73

SHA1 hash:

5339fcfe4e1059f3b0207de13fdf72b0774eeca7

Link:

https://www.unpac.me/results/a3dd665d-368a-41ee-81f7-cdbea438cf9c/

Malware family:

XMRig

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/237e6ff6b831/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/237e6ff6b83166d19edabf4cade3cec3ceb4b9665b70c52d4b0e79b9670d8846

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CMD_Ping_Localhost Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	ProgramLanguage_Rust Create hunting rule
Author:	albertzsigovits
Description:	Application written in Rust programming language

Rule name:	Rustyloader_mem_loose Create hunting rule
Author:	James_inthe_box
Description:	Corroded buerloader
Reference:	https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/