MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48a9a9ec75caf2b45a7a78c63d339aae96c2eab2d5510c974544bb04f49e0948. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	48a9a9ec75caf2b45a7a78c63d339aae96c2eab2d5510c974544bb04f49e0948
SHA3-384 hash:	0e4fa78ed28bb1c2aee69d99644d32696fa34ad37c2ff03cd573fafc42e561ee253728a66fde951aa0d1f39778cc19ed
SHA1 hash:	02a2e35700b64fe7c5a21d820e6c8690b5e9892a
MD5 hash:	1acba05841862954122086449b034dc3
humanhash:	high-one-beer-muppet
File name:	i686
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	5'107'292 bytes
First seen:	2026-07-19 06:20:49 UTC
Last seen:	Never
File type:	elf
MIME type:	application/x-executable
ssdeep	98304:ial8QeIviTsWm8F4CGNmyXP/WOkdWeyAFgyTKA9YScpOK7Q5X:ial8WBUFY/cWkz7
TLSH	T130367C88E793E0F0E65308F0559BDAF761305B355053F6F2EB8A6B65B4323416F093AA
telfhash	t14c82b07301dc64e8abe08547836f7174cff6e0e72a9029f164e57cd19ab2c826926d78
TrID	50.1% (.) ELF Executable and Linkable format (Linux) (4022/12) 49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Magika	elf
Reporter	abuse_ch
Tags:	CoinMiner elf upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 a485511f190cca50a45098bddd4f45f7bdeb8467f12cf726d1659fa3326aa5be

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

81

Origin country :

NL

Vendor Threat Intelligence

ACCE MurmurHash3_32

Details

Link:

https://research.acce.ciphertechsolutions.com/results/c950f457-eb70-4036-bd38-df5aea4abce0/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Variant.Application.Linux.Miner.3.86781592.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Kills processes

Receives data from a server

Launching a process

Changes the time when the file was created, accessed, or modified

Sends data to a server

Connection attempt

Runs as daemon

Collects information on the CPU

Changes access rights for a written file

Collects information on the RAM

Creating a file

Substitutes an application name

Creates or modifies files in /cron to set up autorun

Performs a bruteforce attack in the network

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

base64 expand gcc lolbin rust

Link:

https://www.filescan.io/uploads/6a5c6ce8abef429e5d92e31a/reports/90fe006d-9eac-462f-a0a6-a0699a50f89f/overview

ELF DIGEST Malicious

Verdict:

Malicious

Uses P2P?:

false

Uses anti-vm?:

false

Architecture:

x86

Packer:

not packed

Botnet:

unknown

Number of open files:

0

Number of processes launched:

1

Processes remaning?

false

Remote TCP ports scanned:

not identified

Full report:

https://elfdigest.com/brief/48a9a9ec75caf2b45a7a78c63d339aae96c2eab2d5510c974544bb04f49e0948

Behaviour

no suspicious findings

Botnet C2s

TCP botnet C2(s):

not identified

UDP botnet C2(s):

not identified

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

elf.32.le

First seen:

2026-07-19T04:17:00Z UTC

Last seen:

2026-07-21T01:23:00Z UTC

Hits:

~10000

Link:

https://opentip.kaspersky.com/48a9a9ec75caf2b45a7a78c63d339aae96c2eab2d5510c974544bb04f49e0948/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/23fd6123-6459-4c08-9e65-682ecfc45471

Behavior Graph:

Download SVG

Intezer

Gathering data

Joe Sandbox Xmrig

Result

Threat name:

Xmrig

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1944727

Signature

Antivirus / Scanner detection for submitted sample

Connects to many ports of the same IP (likely port scanning)

Executes the "crontab" command typically for achieving persistence

Executes the "iptables" command to insert, remove and/or manipulate rules

Found strings related to Crypto-Mining

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Opens /sys/class/net/* files useful for querying network interface information

Sample tries to persist itself using cron

Uses known network protocols on non-standard ports

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ELF

Link:

https://malprob.io/report/48a9a9ec75caf2b45a7a78c63d339aae96c2eab2d5510c974544bb04f49e0948

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/48a9a9ec75caf2b45a7a78c63d339aae96c2eab2d5510c974544bb04f49e0948/

ReversingLabs TitaniumCloud Linux.Coinminer.XMRig

Threat name:

Linux.Coinminer.XMRig

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-19 06:22:37 UTC

File Type:

ELF32 Little (Exe)

AV detection:

12 of 24 (50.00%)

Threat level:

  4/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jcu2t3dvzlzliwt2pddd2m42v2lmf2vs2viqzf2fis5qj5e6bfea._file

Hatching Triage xmrig

Result

Malware family:

xmrig

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xmrig antivm defense_evasion discovery execution linux miner persistence privilege_escalation

Link:

https://tria.ge/reports/260719-g4kfnsgs4z/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Changes its process name

Checks CPU configuration

Reads CPU attributes

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads hardware information

Reads network interface configuration

Creates Raw socket

Flushes firewall rules

Unexpected DNS network traffic destination

Contacts a large (352182) amount of remote hosts

Creates a large amount of network flows

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.