MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f0e6cde8582fcd7f80ce8d84cb610d29a9f7f14345ceac77bc991f807668a63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 12

Intelligence 12 IOCs YARA 2 File information Comments

SHA256 hash:	4f0e6cde8582fcd7f80ce8d84cb610d29a9f7f14345ceac77bc991f807668a63
SHA3-384 hash:	a06bfa3866142cbc14c6f9400d4754cc81d0bfabb195c912f93eb3958c0c1c2fd210735a27e32f6555fb3f1b9f60b28f
SHA1 hash:	03afc24a533c79315708e73cbee1caabdc640cf4
MD5 hash:	a5efd34af85582157f7e10b82494df9b
humanhash:	three-yankee-comet-georgia
File name:	SecuriteInfo.com.Trojan.InjectNET.14.26961.17829
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	31'193'600 bytes
First seen:	2025-07-05 13:27:51 UTC
Last seen:	2025-07-05 14:40:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	02549ff92b49cce693542fc9afb10102 (89 x CoinMiner, 2 x CoinMiner.XMRig, 1 x AgentTesla)
ssdeep	393216:24ZE1fikWKHkW4ckqOrzurMtTDcQarCwKqvcjjUC/hta+t8CmBDTtKIqWcjS7Sgt:Rql5yrtvZhjUJkgxLmS7SEf0
Threatray	48 similar samples on MalwareBazaar
TLSH	T1296733517F998C88FD2124B699157B0C77101823714E2FABB9CFB0DA5D4E6F8E728B81
TrID	38.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.6% (.ICL) Windows Icons Library (generic) (2059/9) 15.4% (.EXE) OS/2 Executable (generic) (2029/13) 15.2% (.EXE) Generic Win/DOS Executable (2002/3) 15.2% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	CoinMiner exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

rl_4f0e6cde8582fcd7f80ce8d84cb610d29a9f7f14345ceac77bc991f807668a63

Verdict:

No threats detected

Analysis date:

2025-07-05 13:46:38 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/9873baa2-f306-4025-88c1-444d5d8d1c99

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68692886900df8e7f86717dd

Tags:

autorun virus shell sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Using the Windows Management Instrumentation requests

Creating a process from a recently created file

Creating a process with a hidden window

DNS request

Sending a custom TCP request

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed packed

Link:

https://www.filescan.io/uploads/6869288e6b0fcfc5e2e02292/reports/6acdd842-2cff-4fe3-803a-5c0795d7b358/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/4f0e6cde8582fcd7f80ce8d84cb610d29a9f7f14345ceac77bc991f807668a63

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/4f0e6cde8582fcd7f80ce8d84cb610d29a9f7f14345ceac77bc991f807668a63

Gathering data

Threat name:

Win64.Trojan.Donut

Status:

Malicious

First seen:

2025-07-05 13:28:30 UTC

File Type:

PE+ (Exe)

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j4hgzxufql6np6am5dmeznqq2knj67yugroovr33zgi7qb3grjrq._file

Verdict:

malicious

Label(s):

donut_injector

CoinMiner

339548732c218088c210056bbce8f7fe71b3beacf8533c58ca88416c681a800c

CoinMiner

36e7fd5a585b07f1461a7a43797ce55439d311a397ba5d0a22390684fc14d0a0

CoinMiner

3b511930020a90cdf0be7ea36c59781d018345a5fdc73b4ec126927dacc41e48

CoinMiner

569a8764efb31a8c7a271ced3982f763c0f85ac10b8a6c17a0d9ffa3550f0679

CoinMiner

7282004c0d02019b16529ab753202f521dde539bc58083c3658d459398c6e514

CoinMiner

d3573e019cb282db92a23ead87196558de89971879e987e4223297b2c70d9b38

CoinMiner

d7f3b45b5c59a96db7bed6de2c45692671867d3476ba50097932ba1dbc1c2890

CoinMiner

error

CoinMiner

+ 38 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig execution miner persistence

Link:

https://tria.ge/reports/250705-qqwq8azlx7/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of SetThreadContext

Executes dropped EXE

XMRig Miner payload

Xmrig family

xmrig

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/320bdf43-faea-4c59-ac53-19228625aa03

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.52

Link:

https://yomi.yoroi.company/submissions/4f0e6cde8582fcd7f80ce8d84cb610d29a9f7f14345ceac77bc991f807668a63

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	botnet_plaintext_c2 Create hunting rule
Author:	cip
Description:	Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

exe 4f0e6cde8582fcd7f80ce8d84cb610d29a9f7f14345ceac77bc991f807668a63

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3576637/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CreateProcessA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample