MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bf4dc090d790d0101f61dafb9fcff37c65e32b0b321ab7a03585deb786376fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bf4dc090d790d0101f61dafb9fcff37c65e32b0b321ab7a03585deb786376fb
SHA3-384 hash: ad68c2a19778cd6374f3413162b7bd8a47da0e1c39f23176ee99002ef33bfbe80e4a0daf914d28710a70008f2db70cf4
SHA1 hash: 5ca5936bc918db2e3332a62bae1ee5dab969fbaf
MD5 hash: 4a0b00ec48a3b26e8952b803da536f50
humanhash: king-six-happy-lithium
File name:Aura.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:19'067'592 bytes
First seen:2026-07-31 08:37:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 45b19dde673141d47d300fba9eaeeab1 (1 x CoinMiner)
ssdeep 393216:a+YVzAdwNeeVJC+e/qBF+SwgVUqVeFiyDFz:aV5AuNJVJC+d3+Swg+UUDFz
TLSH T1261723D779EEE2A8C0C34F04A98613CE24D171AD85BA951E3ACF6C03B521D578AC9737
TrID 44.6% (.EXE) Win64 Executable (generic) (6522/11/2)
14.0% (.ICL) Windows Icons Library (generic) (2059/9)
13.8% (.EXE) OS/2 Executable (generic) (2029/13)
13.7% (.EXE) Generic Win/DOS Executable (2002/3)
13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter burger
Tags:CoinMiner exe signed

Code Signing Certificate

Organisation:Inventory
Issuer:Inventory
Algorithm:sha256WithRSAEncryption
Valid from:2026-07-30T17:21:26Z
Valid to:2028-07-30T17:31:26Z
Serial number: 4803679501676db3472c4397080612b2
Thumbprint Algorithm:SHA256
Thumbprint: aa11752cc043d760cf3cbfb2ece787f5613a62d20ea3a4836fdc060cc1925799
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
186
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/744bf662-770c-4e15-86ad-413f546cc833/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/76925/
Result
Verdict:
Clean
Maliciousness:
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
packed signed
Link:
https://www.filescan.io/uploads/6a6c5ecdf20d774052e4bc1a/reports/e9375e41-5aa1-4f30-9cfc-cb0cdd9d2392/overview
Verdict:
Malicious
Labled as:
Trojan_Win32_Wacatac_B_ml
Link:
https://www.hybrid-analysis.com/sample/2bf4dc090d790d0101f61dafb9fcff37c65e32b0b321ab7a03585deb786376fb
Verdict:
Clean
File Type:
exe x64
First seen:
2026-07-30T16:27:00Z UTC
Last seen:
2026-07-31T05:41:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/2bf4dc090d790d0101f61dafb9fcff37c65e32b0b321ab7a03585deb786376fb/results?tab=lookup
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
evad.troj.spyw.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1950537
Signature
Adds a directory exclusion to Windows Defender
AI detected suspicious PE / MSI digital signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates / moves files in alternative data streams (ADS)
Creates an undocumented autostart registry key
Deletes itself after installation
Found direct / indirect Syscall (likely to bypass EDR)
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Modifies windows update settings
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Protects its processes via BreakOnTermination flag
Queries DNS domain through GetComputerNameExW (potential sandbox evasion)
Sample is not signed and drops a device driver
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Schedule system process
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Unusual module load detection (module proxying)
Uses cmd line tools excessively to alter registry or file data
Uses nslookup.exe to query domains
Uses schtasks.exe or at.exe to add and modify task schedules
Verifies if a H.264 Video Encoder exists (likely to detect the VM)
Writes to foreign memory regions
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1950537 Sample: Aura.exe Startdate: 31/07/2026 Architecture: WINDOWS Score: 100 125 serve.eastpeak.xyz 2->125 127 route.techquarter.xyz 2->127 129 12 other IPs or domains 2->129 151 Suricata IDS alerts for network traffic 2->151 153 Malicious sample detected (through community Yara rule) 2->153 155 Antivirus detection for URL or domain 2->155 159 9 other signatures 2->159 11 Aura.exe 82 2->11         started        16 LockAppHost14a02b.exe 2->16         started        18 UsoClient34ed49.exe 33 2->18         started        20 SmartScreenHost27dac.exe 2->20         started        signatures3 157 Performs DNS queries to domains with low reputation 127->157 process4 dnsIp5 145 193.233.75.215, 49860, 80 DHOST-ASRU Germany 11->145 147 route.ambergroup.one 104.21.95.63, 443, 49859 CLOUDFLARENET-CloudflareIncUS Canada 11->147 117 C:\Users\user\AppData\...\yxzkruxfpa.exe, PE32+ 11->117 dropped 119 C:\Users\user\AppData\...\ux6ezjg3d8.exe, PE32+ 11->119 dropped 121 C:\Users\user\AppData\...\lz1vtr6h0g.exe, PE32+ 11->121 dropped 123 C:\Users\user\AppData\...\k7mxhq3wb5.exe, PE32+ 11->123 dropped 197 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 11->197 199 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->199 201 Creates / moves files in alternative data streams (ADS) 11->201 211 7 other signatures 11->211 22 k7mxhq3wb5.exe 98 11->22         started        27 ux6ezjg3d8.exe 10 11->27         started        29 yxzkruxfpa.exe 11->29         started        31 lz1vtr6h0g.exe 11->31         started        203 Antivirus detection for dropped file 16->203 205 Uses nslookup.exe to query domains 16->205 207 Writes to foreign memory regions 16->207 213 3 other signatures 16->213 149 polygon.gateway.tenderly.co 35.227.193.242, 443, 49862, 49863 GOOGLE-CLOUD-PLATFORM-GoogleLLCUS United States 18->149 209 Found direct / indirect Syscall (likely to bypass EDR) 18->209 33 schtasks.exe 18->33         started        file6 signatures7 process8 dnsIp9 131 serve.eastpeak.xyz 172.67.161.115, 443, 49866 CLOUDFLARENET-CloudflareIncUS Canada 22->131 101 C:\Users\...\SmartScreenHost27dac.exe (copy), PE32+ 22->101 dropped 169 Antivirus detection for dropped file 22->169 171 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 22->171 173 Suspicious powershell command line found 22->173 183 4 other signatures 22->183 35 explorer.exe 22->35 injected 38 schtasks.exe 22->38         started        40 powershell.exe 22->40         started        103 C:\Users\user\AppData\...\UsoClient34ed49.exe, PE32+ 27->103 dropped 105 :n (copy), PE32+ 27->105 dropped 175 Creates / moves files in alternative data streams (ADS) 27->175 177 Uses schtasks.exe or at.exe to add and modify task schedules 27->177 179 Found direct / indirect Syscall (likely to bypass EDR) 27->179 42 UsoClient34ed49.exe 33 27->42         started        45 schtasks.exe 1 27->45         started        107 C:\Users\user\...\MusNotificationce794c.exe, PE32+ 29->107 dropped 109 :x (copy), PE32+ 29->109 dropped 181 Creates an undocumented autostart registry key 29->181 47 MusNotificationce794c.exe 29->47         started        49 conhost.exe 29->49         started        111 C:\ProgramData\...\LockAppHost14a02b.exe, PE32+ 31->111 dropped 113 :r (copy), PE32+ 31->113 dropped 53 3 other processes 31->53 51 conhost.exe 33->51         started        file10 signatures11 process12 dnsIp13 161 Uses nslookup.exe to query domains 35->161 55 nslookup.exe 35->55         started        60 conhost.exe 38->60         started        62 conhost.exe 40->62         started        139 polygon.drpc.org 104.18.11.59, 443, 49861 CLOUDFLARENET-CloudflareIncUS Canada 42->139 141 build.netbazaar.lol 104.21.87.185, 443, 49864, 49865 CLOUDFLARENET-CloudflareIncUS Canada 42->141 163 Antivirus detection for dropped file 42->163 165 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 42->165 167 Found direct / indirect Syscall (likely to bypass EDR) 42->167 64 schtasks.exe 42->64         started        66 conhost.exe 45->66         started        143 route.techquarter.xyz 104.21.46.61 CLOUDFLARENET-CloudflareIncUS Canada 47->143 68 conhost.exe 51->68         started        70 conhost.exe 53->70         started        72 conhost.exe 53->72         started        74 conhost.exe 53->74         started        signatures14 process15 dnsIp16 133 kong.nv.onfinality.io 142.215.53.55 EQUINIXNL United States 55->133 135 polygon-public.nodies.app 104.26.5.88 CLOUDFLARENET-CloudflareIncUS Canada 55->135 137 2 other IPs or domains 55->137 115 C:\Windows\Temp\oeoajqda.sys, PE32+ 55->115 dropped 185 Suspicious powershell command line found 55->185 187 Protects its processes via BreakOnTermination flag 55->187 189 Uses cmd line tools excessively to alter registry or file data 55->189 191 7 other signatures 55->191 76 powershell.exe 55->76         started        79 powershell.exe 55->79         started        81 sc.exe 55->81         started        85 19 other processes 55->85 83 conhost.exe 64->83         started        file17 signatures18 process19 signatures20 193 Found many strings related to Crypto-Wallets (likely being stolen) 76->193 195 Loading BitLocker PowerShell Module 76->195 87 conhost.exe 76->87         started        89 conhost.exe 79->89         started        91 conhost.exe 81->91         started        93 conhost.exe 85->93         started        95 conhost.exe 85->95         started        97 conhost.exe 85->97         started        99 14 other processes 85->99 process21
Score:
75%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2bf4dc090d790d0101f61dafb9fcff37c65e32b0b321ab7a03585deb786376fb
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/4a0b00ec48a3b26e8952b803da536f50
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2bf4dc090d790d0101f61dafb9fcff37c65e32b0b321ab7a03585deb786376fb/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fp2nycinpegqcapwdwx3t7h7g7df4mvqwmq2w6qdlbo6w6ddo35q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260731-kjdzyayckb/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
2bf4dc090d790d0101f61dafb9fcff37c65e32b0b321ab7a03585deb786376fb
MD5 hash:
4a0b00ec48a3b26e8952b803da536f50
SHA1 hash:
5ca5936bc918db2e3332a62bae1ee5dab969fbaf
Link:
https://www.unpac.me/results/c0691a72-1b20-486d-a0b7-84840f302df1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2bf4dc090d790d0101f61dafb9fcff37c65e32b0b321ab7a03585deb786376fb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/76925/

Comments