🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b4098a38f150416a1b2064ffa82982e6ce2d836b9ef9d906d55a9e66d3a87bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 18


Intelligence 18 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b4098a38f150416a1b2064ffa82982e6ce2d836b9ef9d906d55a9e66d3a87bd
SHA3-384 hash: f10401b33407a0e75c86d14dd315de85eb5120390c4f01d55453888a41ccbfc8c57a63beb3fb1be9b05b31a055ae7810
SHA1 hash: b43f9abe12df091885a1dc53a4c52706ea785853
MD5 hash: 6e6faf90ad6127b0f968f97329a70706
humanhash: table-mountain-eight-bravo
File name:file
Download: download sample
Signature CoinMiner
Create hunting rule
File size:82'944 bytes
First seen:2026-10-27 23:50:43 UTC
Last seen:2026-10-28 00:34:03 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 2b1576a7a1f4aa6570bb1a33aca4c56e (3 x Phorpiex, 2 x CoinMiner)
ssdeep 1536:nGYo3lPQFmav82YLO+bdxGWEBedhlcvASRzh4pG66AXyVS2:fo1XOQLOWxBieCv94pG66AX3
TLSH T12C833910F6D08236F0F640FBD2FB16BA5D2CEEB4630654D753D1A8AF6B249C0A93156B
TrID 36.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
14.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.4% (.EXE) Win64 Executable (generic) (6522/11/2)
11.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter Bitsight
Tags:CoinMiner dropped-by-phorpiex exe


Avatar
Bitsight
url: http://193.178.158.62/twizt

Intelligence

File Origin
# of uploads :
10
# of downloads :
184
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/22146d23-84f6-4f35-84fa-da135057f333/
Malware family:
phorpiex
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-27 23:53:16 UTC
Tags:
auto-reg phorpiex botnet miner xmrig winring0-sys vuln-driver xor-url generic
Link:
https://app.any.run/tasks/bbbf6eec-d483-456b-94eb-d1fc225c196e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Phorpiex
Create hunting rule
Link:
https://www.capesandbox.com/analysis/95554/
Detection(s):
SecuriteInfo.com.Trojan.Siggen34.32112.18399.28618.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae138f63a56bbccb37bfcde
Tags:
downloader phorpiex dropper sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto explorer fingerprint lolbin microsoft_visual_cc
Link:
https://www.filescan.io/uploads/6ae138f3396843b93f40fea9/reports/e7a2b603-b47e-414f-8816-7dd5087c0050/overview
Verdict:
Malicious
Labled as:
Worm.Phorpiex.Generic
Link:
https://www.hybrid-analysis.com/sample/2b4098a38f150416a1b2064ffa82982e6ce2d836b9ef9d906d55a9e66d3a87bd
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-27T21:01:00Z UTC
Last seen:
2026-10-29T17:46:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/2b4098a38f150416a1b2064ffa82982e6ce2d836b9ef9d906d55a9e66d3a87bd/results?tab=lookup
Malware family:
Phorpiex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cfaaf400-9e56-4a1d-a5d2-74994c6ea4a6
Result
Threat name:
Phorpiex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1993538
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to check if Internet connection is working
Drops executables to the windows directory (C:\Windows) and starts them
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Tries to detect sleep reduction / modifications
Yara detected Phorpiex
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1993538 Sample: file.exe Startdate: 28/10/2026 Architecture: WINDOWS Score: 100 80 Suricata IDS alerts for network traffic 2->80 82 Found malware configuration 2->82 84 Antivirus / Scanner detection for submitted sample 2->84 86 3 other signatures 2->86 9 file.exe 1 1 2->9         started        13 syskrovolav.exe 2->13         started        process3 file4 64 C:\Windows\syskrovolav.exe, PE32 9->64 dropped 94 Found evasive API chain (may stop execution after checking mutex) 9->94 96 Contains functionality to check if Internet connection is working 9->96 98 Drops executables to the windows directory (C:\Windows) and starts them 9->98 100 2 other signatures 9->100 15 syskrovolav.exe 41 9->15         started        signatures5 process6 dnsIp7 66 94.141.86.150, 40500 TPSUZ-ASEASTTELECOMISPETTPSEVOUZ Uzbekistan 15->66 68 102.157.119.97, 40500 TOPNETTN Tunisia 15->68 70 55 other IPs or domains 15->70 54 C:\Users\user\AppData\...\3977535413.exe, PE32+ 15->54 dropped 56 C:\Users\user\AppData\...\1795614962.exe, PE32+ 15->56 dropped 58 C:\Users\user\AppData\Local\...\165809034.exe, PE32+ 15->58 dropped 60 C:\Users\user\AppData\...\1370229129.exe, PE32 15->60 dropped 72 Antivirus detection for dropped file 15->72 74 Multi AV Scanner detection for dropped file 15->74 76 Found evasive API chain (may stop execution after checking mutex) 15->76 78 3 other signatures 15->78 20 1370229129.exe 27 15->20         started        24 165809034.exe 2 15->24         started        26 3977535413.exe 2 15->26         started        28 1795614962.exe 2 15->28         started        file8 signatures9 process10 file11 62 C:\Users\user\AppData\...\4030515790.exe, PE32+ 20->62 dropped 88 Antivirus detection for dropped file 20->88 90 Multi AV Scanner detection for dropped file 20->90 92 Hides that the sample has been downloaded from the Internet (zone.identifier) 20->92 30 cmd.exe 24->30         started        32 cmd.exe 26->32         started        34 cmd.exe 1 28->34         started        signatures12 process13 process14 36 conhost.exe 30->36         started        38 reg.exe 1 30->38         started        40 sc.exe 1 30->40         started        42 conhost.exe 32->42         started        44 reg.exe 1 32->44         started        46 sc.exe 1 32->46         started        48 conhost.exe 34->48         started        50 reg.exe 1 34->50         started        52 sc.exe 1 34->52         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2b4098a38f150416a1b2064ffa82982e6ce2d836b9ef9d906d55a9e66d3a87bd
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/6e6faf90ad6127b0f968f97329a70706
Detection:
phorpiex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2b4098a38f150416a1b2064ffa82982e6ce2d836b9ef9d906d55a9e66d3a87bd/
Threat name:
Win32.Worm.Phorpiex
Create hunting rule
Status:
Malicious
First seen:
2026-10-27 23:51:43 UTC
File Type:
PE (Exe)
AV detection:
32 of 38 (84.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fnajri4pcucbninsazh7vauyfzwofwbwxhxz3ednkwu6m3j2q66q._file
Verdict:
malicious
Label(s):
Phorpiex
Create hunting rule
unc_loader_055
Create hunting rule
Link:
https://reports.threatray.com/55c5fcfa-1c9e-4ab4-bc33-b2d10c43a468
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery execution persistence
Link:
https://tria.ge/reports/261027-3v8mssxwax/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Windows directory
Launches sc.exe
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Stops running service(s)
Downloads MZ/PE file
Unpacked files
SH256 hash:
2b4098a38f150416a1b2064ffa82982e6ce2d836b9ef9d906d55a9e66d3a87bd
MD5 hash:
6e6faf90ad6127b0f968f97329a70706
SHA1 hash:
b43f9abe12df091885a1dc53a4c52706ea785853
Link:
https://www.unpac.me/results/fa6629f9-db57-4d63-9083-564c53db7880/
Malware family:
Phorpiex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2b4098a38f15/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Phorpiex
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/2b4098a38f150416a1b2064ffa82982e6ce2d836b9ef9d906d55a9e66d3a87bd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Win_Clipboard_Clipper_Thengavar
Create hunting rule
Author:Thengavar
Description:Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks
Rule name:WIN_Clipper_Unknown_ClipboardHijack
Create hunting rule
Author:Marjoriefort
Description:DLL clipper (detournement presse-papiers crypto) : API clipboard completes + DLL compacte
Reference:misses_archive 569 / cluster 282 DLL x 15360 o

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 2b4098a38f150416a1b2064ffa82982e6ce2d836b9ef9d906d55a9e66d3a87bd

(this sample)

  
Dropped by
Phorpiex
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/95554/

Comments