MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43b9cfbfd524d138da3312b47fcee8c4c9ab9343d89fe7b4b730f73c940fbfef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 13


Intelligence 13 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43b9cfbfd524d138da3312b47fcee8c4c9ab9343d89fe7b4b730f73c940fbfef
SHA3-384 hash: 98347f09ebd4e04e39cc61f11c901e9a24e14f0d66d0f576631924e0b75c55bf0dd850692d37a42c6897f722658552f1
SHA1 hash: 01bc3c863028802493d26fa57676a64c0726009a
MD5 hash: 5059b45c08e23bbfae10f3185c9ab692
humanhash: montana-spring-oranges-may
File name:file
Download: download sample
Signature CoinMiner
Create hunting rule
File size:10'573'053 bytes
First seen:2026-02-21 01:44:49 UTC
Last seen:2026-02-21 02:17:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 324a475069966de421cdd2985bf9bffd (1 x CoinMiner)
ssdeep 98304:EMxkkp1jRdsu1UNIfezt/jb2Q37VnuGknpr77FM59H91gqHstaanWLv:EJgjjsu1UAw/jbx7AGkpzizd1VoaJ
Threatray 40 similar samples on MalwareBazaar
TLSH T121B6BE15A3E901B1D877CA30CA66C733CAB17D965A35C50F0658F2522F73D628BAF326
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:CoinMiner dropped-by-amadey exe fbf543


Avatar
Bitsight
url: http://130.12.180.43/files/5411854720/JyOpiNX.exe

Intelligence

File Origin
# of uploads :
13
# of downloads :
221
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
CoinMiner02
Create hunting rule
Link:
https://www.capesandbox.com/analysis/53954/
Detection(s):
SecuriteInfo.com.FileRepMalware.87491752.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69990e318fffa866e3aff83e
Tags:
vmdetect xmrig
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-vm crypto microsoft_visual_cc net overlay packed
Link:
https://www.filescan.io/uploads/69990e2d10e80629d4ec2052/reports/7f60cbe5-f4d4-42b1-b74d-c67910e37191/overview
Verdict:
Malicious
Labled as:
Cerbu.Generic
Link:
https://www.hybrid-analysis.com/sample/43b9cfbfd524d138da3312b47fcee8c4c9ab9343d89fe7b4b730f73c940fbfef
Result
Gathering data
Malware family:
XMRig Miner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b2ef2577-0da5-4eea-92b4-07382bc414a1
Score:
93%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/43b9cfbfd524d138da3312b47fcee8c4c9ab9343d89fe7b4b730f73c940fbfef
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/43b9cfbfd524d138da3312b47fcee8c4c9ab9343d89fe7b4b730f73c940fbfef/
Verdict:
Malicious
Threat:
Trojan-PSW.Win32.Disco
Link:
https://tip.neiki.dev/file/43b9cfbfd524d138da3312b47fcee8c4c9ab9343d89fe7b4b730f73c940fbfef
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=io447p6vetitrwrtck2h7txiyte2xe2d3cp6pnfxgd3tzfapx7xq._file
Verdict:
malicious
Label(s):
xmrig
Create hunting rule
Similar samples:
242141d9d23761573731b5f0a0f2a5039a6b8bb5209e167d93ea804802f15762
CoinMiner
3b93465de33b87e03e1932381c60acfd13f461e6ce8cc129b2ca0d04680321f8
CoinMiner
43b9cfbfd524d138da3312b47fcee8c4c9ab9343d89fe7b4b730f73c940fbfef
CoinMiner
661c4da0df6414e3cf7855d47a142cc9858c1174cc992f29423e48ce420585e0
CoinMiner
efac57361fa125ca73858831c5b7a1e8f236add5c534925c98c48204328c8540
CoinMiner
error
CoinMiner
+ 30 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig execution miner persistence
Link:
https://tria.ge/reports/260221-b6h3qsct7g/
Behaviour
Checks processor information in registry
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Looks up external IP address via web service
Executes dropped EXE
XMRig Miner payload
Xmrig family
xmrig
Unpacked files
SH256 hash:
43b9cfbfd524d138da3312b47fcee8c4c9ab9343d89fe7b4b730f73c940fbfef
MD5 hash:
5059b45c08e23bbfae10f3185c9ab692
SHA1 hash:
01bc3c863028802493d26fa57676a64c0726009a
Link:
https://www.unpac.me/results/f7f1450c-7229-462f-b389-c322bbc0fbfd/
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/43b9cfbfd524/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/43b9cfbfd524d138da3312b47fcee8c4c9ab9343d89fe7b4b730f73c940fbfef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
Rule name:Jupyter_infostealer
Create hunting rule
Author:CD_R0M_
Description:Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 43b9cfbfd524d138da3312b47fcee8c4c9ab9343d89fe7b4b730f73c940fbfef

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/53954/
  
URLhaus
https://urlhaus.abuse.ch/url/3782072/

Comments