MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 386aece5751535acf2c60a1cec037ec18da94d6a10237117debccbc0cf8ceaa7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 18

Intelligence 18 IOCs YARA 7 File information Comments

SHA256 hash:	386aece5751535acf2c60a1cec037ec18da94d6a10237117debccbc0cf8ceaa7
SHA3-384 hash:	35aa4908d554a7836fa446e4463cad719db6aa70f4417d23076eececf11d511d3a99d55c6395faa15d2aadf384be19c4
SHA1 hash:	1477adf1fbd8d9e55c3114689934819f524b5b57
MD5 hash:	3f84ee612332dcafeff3e5f5cfafc1de
humanhash:	ohio-king-green-island
File name:	SecuriteInfo.com.PUA.Tool.BtcMine.2842.28356.22463
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	10'575'916 bytes
First seen:	2026-08-30 06:21:57 UTC
Last seen:	2026-08-30 07:32:01 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1dcd477cce07724ec6b817b3be71540e (15 x CoinMiner, 1 x SalatStealer, 1 x BlankGrabber)
ssdeep	196608:ER2eDurHmQnuhHToAUPNfGU5vXvBL2+XamsVnllH8b1OZl+/rF8s2B:EjuC7hHTodRGkXZ2RleF1
TLSH	T172B633AA72D919F8FDF7A139C5634419E7B2B8510731C2FB03E84A622D231F12F36665
TrID	70.9% (.EXE) InstallShield setup (43053/19/16) 10.7% (.EXE) Win64 Executable (generic) (6522/11/2) 8.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.3% (.EXE) OS/2 Executable (generic) (2029/13) 3.3% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	2896969696969696 (17 x CoinMiner, 5 x SalatStealer)
Reporter	SecuriteInfoCom
Tags:	CoinMiner exe

Intelligence

File Origin

# of uploads :

# of downloads :

204

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PyInstaller

Details

Link:

https://research.acce.ciphertechsolutions.com/results/f4184063-76b2-4e63-afbe-56e34f8ca86b/

Malware family:

xmrig

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-08-30 06:34:30 UTC

Tags:

python auto-reg pastebin miner xmrig pyinstaller

Link:

https://app.any.run/tasks/d75f06ff-66f8-4fbc-ab29-84b94f07a505

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

CoinMiner02

Link:

https://www.capesandbox.com/analysis/83295/

Detection(s):

SecuriteInfo.com.PUA.Tool.BtcMine.2842.28356.22463.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac6b7f2c221a7c08107b7ff

Tags:

vmdetect xmrig

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Restart of the analyzed sample

Creating a window

Creating a file

Enabling the 'hidden' option for recently created files

Creating a process from a recently created file

Creating a process with a hidden window

Deleting a recently created file

Replacing files

Сreating synchronization primitives

Creating a file in the %AppData% subdirectories

DNS request

Connection attempt

Sending a custom TCP request

Moving a recently created file

Searching for synchronization primitives

Connection attempt to an infection source

Creating a service

Launching a service

Loading a system driver

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Query of malicious DNS domain

Sending a TCP request to an infection source

Enabling autorun for a service

Adding exclusions to Windows Defender

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug dropper expand hacktool installer-heuristic lolbin microsoft_visual_cc overlay packed packed packed pyinstaller reconnaissance

Link:

https://www.filescan.io/uploads/6a93cc178fc04d3b7b43ed21/reports/9fee6b73-5178-4d50-9059-693cd28ec314/overview

Verdict:

Malicious

Labled as:

Clyp.Generic

Link:

https://www.hybrid-analysis.com/sample/386aece5751535acf2c60a1cec037ec18da94d6a10237117debccbc0cf8ceaa7

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-08-30T03:37:00Z UTC

Last seen:

2026-08-31T18:45:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/386aece5751535acf2c60a1cec037ec18da94d6a10237117debccbc0cf8ceaa7/results?tab=lookup

Malware family:

XMRig Miner

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/dc15f239-10c5-458a-bb7d-21890204b4bf

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/386aece5751535acf2c60a1cec037ec18da94d6a10237117debccbc0cf8ceaa7

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/3f84ee612332dcafeff3e5f5cfafc1de

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/386aece5751535acf2c60a1cec037ec18da94d6a10237117debccbc0cf8ceaa7/

Threat name:

Win64.Trojan.Sonbokli

Status:

Malicious

First seen:

2026-08-30 06:22:23 UTC

File Type:

PE+ (Exe)

Extracted files:

486

AV detection:

24 of 38 (63.16%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hbvozzlvcu22z4wgbiooya36ygg2stlkcarxcf66xtf4bt4m5ktq._file

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig miner persistence pyinstaller

Link:

https://tria.ge/reports/260830-g41snayhng/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Detects Pyinstaller

Adds Run key to start application

Contacts third-party web service commonly abused for C2

Executes dropped EXE

Loads dropped DLL

Family: xmrig

XMRig Miner payload

Unpacked files

SH256 hash:

386aece5751535acf2c60a1cec037ec18da94d6a10237117debccbc0cf8ceaa7

MD5 hash:

3f84ee612332dcafeff3e5f5cfafc1de

SHA1 hash:

1477adf1fbd8d9e55c3114689934819f524b5b57

Link:

https://www.unpac.me/results/9daea8bc-c696-4646-ab51-4ed2959d35ce/

SH256 hash:

007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe

MD5 hash:

8d4805f0651186046c48d3e2356623db

SHA1 hash:

18c27c000384418abcf9c88a72f3d55d83beda91

Link:

https://www.unpac.me/results/9daea8bc-c696-4646-ab51-4ed2959d35ce/

SH256 hash:

052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4

MD5 hash:

32da96115c9d783a0769312c0482a62d

SHA1 hash:

2ea840a5faa87a2fe8d7e5cb4367f2418077d66b

Link:

https://www.unpac.me/results/9daea8bc-c696-4646-ab51-4ed2959d35ce/

SH256 hash:

6fa80698d7268f6e88aa88c06fb27ee99e1bcee747c2e76911e6206a5b1aeeb3

MD5 hash:

d55877f44cd3a93f7f31a5437a615f6e

SHA1 hash:

687076e47a39abd783ba575f5356baefd18ab970

Detections:

XMRig

MALWARE_Win_CoinMiner02

MAL_XMR_Miner_May19_1

XMRIG_Monero_Miner

Link:

https://www.unpac.me/results/9daea8bc-c696-4646-ab51-4ed2959d35ce/

Parent samples :

916cf18c98363cf3419b4d51e9635dd1c610adb3b6d6264aac3f52a02b77541a
386aece5751535acf2c60a1cec037ec18da94d6a10237117debccbc0cf8ceaa7
ae00173d00f74bf65aa244ebf3885ae72c264162b6945af09c1eb7360ba45c44
6fa80698d7268f6e88aa88c06fb27ee99e1bcee747c2e76911e6206a5b1aeeb3
1fd4b7ca731ba501395eb9f93cfdea81a1d1b96c3b3850e654d34ac8a981c446
d85508e7e10f702bd83e1baf01ff85820015666cd5da72add0802fbd30ccaff4
82085eb1c4b7849873d2a186fda979823f1a69acded0e92391ea421be9f880ec
3bc0681c243e8d68365d246aea4ebb351dba1d7d753b134d98d48d8a0018e42d
49cae951cc10bc4c1fce008c7eb1c4850e1c65e55832b318ba9dbf9cd069da52
c4d1b790902c8d3ea0923498af35fc6b99c3633c7353bbb8429651a1cee0f854
66db6047fb9b392f07571278eef75b423f35eb94593a9b57f1ee1bbfb8b09db3

SH256 hash:

eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

MD5 hash:

0f8e4992ca92baaf54cc0b43aaccce21

SHA1 hash:

c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

Link:

https://www.unpac.me/results/9daea8bc-c696-4646-ab51-4ed2959d35ce/

SH256 hash:

f6181f26c550ed06d26ebd5f508e38bd2d3be452c95c0dfe18e64001170c84f3

MD5 hash:

4b7d90126985f656b2d7ac50271050af

SHA1 hash:

9d1f42c9b6c5428de0769810a0bec5b6d3a9b2d4

Link:

https://www.unpac.me/results/9daea8bc-c696-4646-ab51-4ed2959d35ce/

SH256 hash:

fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c

MD5 hash:

962428e9e68d43ecc16f3e33f2ea8667

SHA1 hash:

6d0f349ab2e795b138a64346b784fc7fcdb6d87f

Link:

https://www.unpac.me/results/9daea8bc-c696-4646-ab51-4ed2959d35ce/

Malware family:

XMRig

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/386aece57515/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/386aece5751535acf2c60a1cec037ec18da94d6a10237117debccbc0cf8ceaa7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_PyInstaller Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PyInstaller compiled executables across platforms

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	PyInstaller Create hunting rule
Author:	@bartblaze
Description:	Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/