MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23d9c8b78e16d8b1db68fd04a4b133dd3649bb5c9f237ccf77f5b08d8ea8f8a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 8


Intelligence 8 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23d9c8b78e16d8b1db68fd04a4b133dd3649bb5c9f237ccf77f5b08d8ea8f8a6
SHA3-384 hash: 3ea22e0194390907fcd38a113f0b3993afc79502b435ab296e2191a8ff278d1ff274068102b5975b07e5b8d2c1e7c6e1
SHA1 hash: 33fd681672a19d3438fc3abba6796dbdab5b5772
MD5 hash: 9becf4255266e2c6deddae16c1be39c3
humanhash: lactose-pluto-nebraska-sink
File name:KeePass-2.61.1.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:71'397'348 bytes
First seen:2026-08-14 02:33:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4b200e917ee33d8e56206c360a98a2d3 (3 x NetSupport, 2 x CoinMiner, 1 x ConnectWise)
ssdeep 1572864:/I55gii2OF6yuoq2VsF4Oyms+BlJVNP84GCubGTQCHoYchmhb0XgTqtdUo:FCF4n1eLNP8m4RqSIqYo
TLSH T161F72221358EC53AD92E05B09A6DAA6A962C6D760FB144D7B3DCBD5E2B304C31332F53
TrID 29.5% (.EXE) Win64 Executable (generic) (6522/11/2)
22.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 70cc96969696d471 (2 x Lazarus, 2 x CoinMiner, 1 x LoaderBot)
Reporter aachum
Tags:CoinMiner exe


Avatar
iamaachum
https://keepass.pythonanywhere.com/ => https://www.mediafire.com/folder/rgnz0koaz0ndz

Intelligence

File Origin
# of uploads :
1
# of downloads :
246
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-08-14 02:39:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3120038b-6e33-4439-b186-375918948f48

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Searching for synchronization primitives
Creating a file in the %temp% directory
Deleting a recently created file
Loading a suspicious library
Launching a process
Modifying a system file
Creating a file in the Windows subdirectories
Creating a file
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Searching for the window
Possible injection to a system process
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context advanced_installer anti-debug anti-vm base64 cacls.exe evasive evasive expand fingerprint hacktool installer installer installer-heuristic lolbin microsoft_visual_cc msiexec powershell reconnaissance runonce
Link:
https://www.filescan.io/uploads/6a7e7e7359d164daba632a24/reports/45b02631-36ed-4a82-9fd8-32a78433bcf4/overview
Verdict:
Malicious
Labled as:
Malware/Generic
Link:
https://www.hybrid-analysis.com/sample/23d9c8b78e16d8b1db68fd04a4b133dd3649bb5c9f237ccf77f5b08d8ea8f8a6
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-09T15:16:00Z UTC
Last seen:
2026-06-09T15:47:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/23d9c8b78e16d8b1db68fd04a4b133dd3649bb5c9f237ccf77f5b08d8ea8f8a6/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1958019
Signature
Adds a directory exclusion to Windows Defender
Command shell drops VBS files
Drops executables to the windows directory (C:\Windows) and starts them
Loading BitLocker PowerShell Module
Multi AV Scanner detection for submitted file
Potential malicious VBS script found (suspicious strings)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1958019 Sample: KeePass-2.61.1.exe Startdate: 14/08/2026 Architecture: WINDOWS Score: 100 77 lumtest.com 2->77 79 docs.google.com 2->79 93 Multi AV Scanner detection for submitted file 2->93 95 Sigma detected: WScript or CScript Dropper 2->95 97 Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet 2->97 99 2 other signatures 2->99 10 wscript.exe 1 2->10         started        13 msiexec.exe 98 66 2->13         started        16 KeePass-2.61.1.exe 26 2->16         started        signatures3 process4 file5 107 Wscript starts Powershell (via cmd or directly) 10->107 109 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->109 111 Suspicious execution chain found 10->111 113 WScript reads language and country specific registry keys (likely country aware script) 10->113 18 cmd.exe 3 10->18         started        21 7z.exe 10->21         started        61 C:\Windows\Installer\MSI58C7.tmp, PE32 13->61 dropped 63 C:\Users\user\AppData\Local\...\Update.vbs, ASCII 13->63 dropped 65 C:\Windows\Installer\MSI2BBA.tmp, PE32 13->65 dropped 73 12 other files (none is malicious) 13->73 dropped 115 Drops executables to the windows directory (C:\Windows) and starts them 13->115 24 MSI58C7.tmp 13->24         started        26 msiexec.exe 13->26         started        28 msiexec.exe 13->28         started        67 C:\Users\user\AppData\Local\...\shi2452.tmp, PE32+ 16->67 dropped 69 C:\Users\user\AppData\Local\...\MSI264A.tmp, PE32 16->69 dropped 71 C:\Users\user\AppData\Local\...\MSI25FA.tmp, PE32 16->71 dropped 75 2 other files (none is malicious) 16->75 dropped 30 msiexec.exe 4 16->30         started        signatures6 process7 file8 85 Suspicious powershell command line found 18->85 87 Wscript starts Powershell (via cmd or directly) 18->87 89 Potential malicious VBS script found (suspicious strings) 18->89 91 2 other signatures 18->91 32 wscript.exe 2 1 18->32         started        35 conhost.exe 18->35         started        37 cacls.exe 1 18->37         started        53 C:\Users\user\AppData\...\vcruntime140.dll, PE32+ 21->53 dropped 55 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 21->55 dropped 57 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 21->57 dropped 59 213 other files (none is malicious) 21->59 dropped 39 conhost.exe 21->39         started        signatures9 process10 signatures11 81 Windows Scripting host queries suspicious COM object (likely to drop second stage) 32->81 83 WScript reads language and country specific registry keys (likely country aware script) 32->83 41 cmd.exe 1 32->41         started        process12 signatures13 101 Suspicious powershell command line found 41->101 103 Wscript starts Powershell (via cmd or directly) 41->103 105 Adds a directory exclusion to Windows Defender 41->105 44 powershell.exe 41->44         started        47 powershell.exe 41->47         started        49 conhost.exe 41->49         started        51 cacls.exe 41->51         started        process14 signatures15 117 Loading BitLocker PowerShell Module 44->117
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/23d9c8b78e16d8b1db68fd04a4b133dd3649bb5c9f237ccf77f5b08d8ea8f8a6
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=epm4rn4oc3mldw3i7uckjmjt3u3eto24t4rxzt3x6wyi3dvi7cta._file
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/23d9c8b78e16/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 23d9c8b78e16d8b1db68fd04a4b133dd3649bb5c9f237ccf77f5b08d8ea8f8a6

(this sample)

  
Link
https://tria.ge/260814-ctxk2asxhz/behavioral2
  
Delivery method
Distributed via web download

Comments