MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1
SHA3-384 hash: 860bdbca3135164048d0d83be1aa4d450ae242400573a5fce20b1248240b559566a4643b2c8111b4d491cefc5bb2bc11
SHA1 hash: 829f1ba9e61a4db810cbc9aee89a1cb131f448ca
MD5 hash: 23f67a641b3f622f051839852f1e6ed6
humanhash: quiet-neptune-sodium-arizona
File name:file
Download: download sample
Signature CoinMiner
Create hunting rule
File size:11'776 bytes
First seen:2026-06-01 13:33:52 UTC
Last seen:2026-06-02 08:25:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 42cf01d41ef6dc0627982490afc9cddd (97 x CoinMiner, 10 x Phorpiex)
ssdeep 192:LoPWLS5BQqCxSHO8jZM0KbPFJxTEZmFhqCc:LoSqCsueMPbPFwZ
Threatray 473 similar samples on MalwareBazaar
TLSH T11E32711C2D460331EE5049B8E8754246657C2EE3B397EBDBE633E6CB49D6E4488C192F
TrID 39.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
21.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
8.3% (.EXE) Win64 Executable (generic) (6522/11/2)
6.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter Bitsight
Tags:CoinMiner dropped-by-phorpiex exe


Avatar
Bitsight
url: http://178.16.54.109/2

Intelligence

File Origin
# of uploads :
622
# of downloads :
174
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
phorpiex
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-06-01 13:34:36 UTC
Tags:
phorpiex botnet ip-check auto-reg miner xmrig stealer loader auto generic winring0-sys vuln-driver coinminer
Link:
https://app.any.run/tasks/db7c8d59-9d83-4b5a-9dca-94ad318c36e3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/68714/
Detection(s):
SecuriteInfo.com.Variant.Worm.Phorpiex.153.63144733.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a1d8a5d5a2e3b5e58e4f93e
Tags:
dropper trojan smtp
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Connecting to a non-recommended domain
Sending a custom TCP request
Connection attempt to an infection source
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-debug anti-vm crypto evasive fingerprint microsoft_visual_cc xor-url
Link:
https://www.filescan.io/uploads/6a1d8a5b46e44aecc0c84b04/reports/a4976e9f-accc-4c90-b3f7-25a20b8cb7fb/overview
Verdict:
Malicious
Labled as:
Worm.Phorpiex.Generic
Link:
https://www.hybrid-analysis.com/sample/5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-01T10:53:00Z UTC
Last seen:
2026-06-02T08:14:00Z UTC
Hits:
~1000
Detections:
BSS:Trojan.Win32.Generic Trojan-Spy.Agent.SMTP.C&C HEUR:Trojan-Dropper.Win32.Phorpiex.gen HEUR:Trojan-Downloader.Win32.Agent.gen Trojan.Snojan.HTTP.C&C Trojan.Scar.HTTP.C&C Trojan-Ransom.GandCrypt.UDP.ServerRequest Trojan-Dropper.Win32.Phorpiex.sb Trojan-Dropper.Dinwod.HTTP.C&C PDM:Trojan.Win32.Generic HEUR:Trojan-Dropper.Win32.Phorpiex.pef Trojan.Win32.Wofith.sb RiskTool.Yopmail.UDP.C&C RemoteAdmin.Zoho.UDP.C&C
Link:
https://opentip.kaspersky.com/5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/45c5f2f6-56d8-4c97-a3d9-60ca62438099
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1
Gathering data
Detection:
phorpiex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1/
Verdict:
Malicious
Threat:
Family.COINMINER
Link:
https://tip.neiki.dev/file/5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1
Threat name:
Win32.Worm.Phorpiex
Create hunting rule
Status:
Malicious
First seen:
2026-06-01 13:34:33 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
26 of 38 (68.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l6vixlex2gdkkrwbicuj3z3y6uu7sstgaux7xybcv3ubbu7nwpyq._file
Verdict:
malicious
Label(s):
unc_stealer_015
Create hunting rule
phorpiex
Create hunting rule
unc_loader_055
Create hunting rule
Similar samples:
3d3a49ebbfeb9467d72b94448c8709d4eb616ec9bab5647122f0f98aa983f67f
CoinMiner
54b55b164fef227508f635391c37d23daaf6af7c599a83b3ee17c74263f9d4db
CoinMiner
5549d978e2e00768fc99d95bd7644dfebacc261284e3b19a79e6e4c1f320fa3a
CoinMiner
58edf329460394faceb5b2331f16f2bb2ae79e904e6ebf20a45a89bce619a0e9
CoinMiner
639253caa407233e9947509a4d1be95d05855c2262c35a50eda5aa6adcc5a61b
CoinMiner
87fa7adbad1fe994d57d118c12dac691b0587db0c25e50cebbb8642bd53da08d
CoinMiner
a04fca73e95829e469518d670a84e46ca0271749a6f8cd3dc7c8a3812d6e5ea9
CoinMiner
cbb7f106983ada5701c04030611df1e59ef7cb5431613d4d9c852a19af3d3bf4
CoinMiner
e5ccb90afcfbb5bfea4485765374e8f30b2987459f7f506c879582bca6dcbc16
CoinMiner
error
CoinMiner
+ 463 additional samples on MalwareBazaar
Result
Malware family:
phorphiex
Create hunting rule
Score:
  10/10
Tags:
family:phorphiex discovery loader trojan worm
Link:
https://tria.ge/reports/260601-qt8vysdz9t/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Executes dropped EXE
Downloads MZ/PE file
Family: Phorphiex, Phorpiex
Malware Config
C2 Extraction:
http://178.16.55.240/
http://130.12.180.190/1/
http://130.12.180.190/3/
http://130.12.180.190/4/
http://130.12.180.190/5/
http://130.12.180.190/6/
http://130.12.180.190/7/
http://130.12.180.190/8/
http://130.12.180.190/9/
Unpacked files
SH256 hash:
5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1
MD5 hash:
23f67a641b3f622f051839852f1e6ed6
SHA1 hash:
829f1ba9e61a4db810cbc9aee89a1cb131f448ca
Link:
https://www.unpac.me/results/3be41cff-0006-4e94-a289-54a052f33e21/
Malware family:
Phorpiex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5faa8bac97d1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 5faa8bac97d186a546c140a89de778f529f94a66052ffbe022aee810d3edb3f1

(this sample)

  
Dropped by
Phorpiex
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/68714/

Comments