MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e3e215ecd5ee83376581705a2f076938b2c4b3877cf5577cbe41907d5dc179c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e3e215ecd5ee83376581705a2f076938b2c4b3877cf5577cbe41907d5dc179c
SHA3-384 hash: 7a110f27c92568e05ae7fcfe0cf6a8bff66883363edd0343f426d52cfaa13b631520505fda038e55999361e04de2fcb0
SHA1 hash: e424362d2c194a126df3a5aeac74e54e0862762a
MD5 hash: a69d74278d4fb76b5c38121188bcbcd8
humanhash: grey-minnesota-foxtrot-princess
File name:LosslessCut.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:1'452'032 bytes
First seen:2025-11-28 21:27:57 UTC
Last seen:2025-12-03 15:34:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 37929a2b44e1c872d959c534c06d45a2 (1 x CoinMiner)
ssdeep 24576:apY415HHmR4JAh68oi0MNzvqv1+uEewA05OHg1HAzF4jrNK6E:4jPwKc2i0uzsEJEEAUNA
TLSH T1DB650173B04A30D4D1F6C2BD78E7B17682776D3A4E611847244AB23A3A7AC7D8C19E5C
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter aachum
Tags:77-91-70-231 77-91-70-237 dropped-by-LummaStealer exe


Avatar
iamaachum
http://164.92.129.208/temp/LosslessCut.exe

Drops https://delledox.com/temp/build.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
tQX4-KMSpico.rar
Verdict:
Malicious activity
Analysis date:
2025-11-14 16:20:27 UTC
Tags:
autoit lumma stealer loader
Link:
https://app.any.run/tasks/440b45a0-5715-4573-ada7-a8cb836ea21f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/41754/
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=692a13f46cb1dcd577822438
Tags:
virus remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug evasive fingerprint installer installer installer-heuristic keylogger microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/692a13ea1b65ca0bb926f5d3/reports/3f816fbe-75b5-482e-a00c-4a28fe7298c2/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/5e3e215ecd5ee83376581705a2f076938b2c4b3877cf5577cbe41907d5dc179c
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-11-14T21:04:00Z UTC
Last seen:
2025-11-30T12:27:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Agent.xcavky Trojan.Win32.Agent.rnd
Link:
https://opentip.kaspersky.com/5e3e215ecd5ee83376581705a2f076938b2c4b3877cf5577cbe41907d5dc179c/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/f7a2fe4a-9d45-4b5a-b703-e8fc532f8fc2
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1822565
Signature
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5e3e215ecd5ee83376581705a2f076938b2c4b3877cf5577cbe41907d5dc179c
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e3e215ecd5ee83376581705a2f076938b2c4b3877cf5577cbe41907d5dc179c/
Verdict:
Malicious
Threat:
Trojan.Win32.Agent
Link:
https://tip.neiki.dev/file/5e3e215ecd5ee83376581705a2f076938b2c4b3877cf5577cbe41907d5dc179c
Threat name:
Win64.Malware.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-11-15 01:36:23 UTC
File Type:
PE+ (Exe)
Extracted files:
15
AV detection:
5 of 36 (13.89%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ly7ccxwnl3udg5syc4c2f4dwsofsyszyo7hvk56l4qmqpvo4c6oa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/251128-1cgp9a1qdl/
Behaviour
Checks computer location settings
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c8f27fdb-b9a1-490a-92c3-12ae251ee34b
Unpacked files
SH256 hash:
5e3e215ecd5ee83376581705a2f076938b2c4b3877cf5577cbe41907d5dc179c
MD5 hash:
a69d74278d4fb76b5c38121188bcbcd8
SHA1 hash:
e424362d2c194a126df3a5aeac74e54e0862762a
Link:
https://www.unpac.me/results/547b9284-38c3-4608-a462-d692d363cc68/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5e3e215ecd5e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5e3e215ecd5ee83376581705a2f076938b2c4b3877cf5577cbe41907d5dc179c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Debugger
Create hunting rule
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 5e3e215ecd5ee83376581705a2f076938b2c4b3877cf5577cbe41907d5dc179c

(this sample)

CoinMiner

Executable exe f48b9780ca6899aac3084bf8c620296d4038cab9ce1e70568e0574ed2e4b4df5

  
Link
https://tria.ge/251128-zyex4sap3y/behavioral1
  
Dropped by
LummaStealer
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/41754/
  
Dropping
SHA256 f48b9780ca6899aac3084bf8c620296d4038cab9ce1e70568e0574ed2e4b4df5
  
Dropping
MD5 ddb11dcf20ea85a899eace23a5fcc486

Comments