🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62c8be142fb4b3b2e04dd92cb10b7a289f958ab40097ff199d467fc0e0dab5a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 15


Intelligence 15 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62c8be142fb4b3b2e04dd92cb10b7a289f958ab40097ff199d467fc0e0dab5a6
SHA3-384 hash: ce86e19a3c317a7f6a5421b0d5d76fd0d6fd452f9ea9d3e07ac8f16cd633e656e13feb06b92143e59a96bf5e5a670f12
SHA1 hash: c150aa4547a4e89be94ff3fb8fa379b5ca6b4652
MD5 hash: 40213f03b5d8e6900b3f9e7f68330605
humanhash: nevada-pizza-finch-fourteen
File name:62c8be142fb4b3b2e04dd92cb10b7a289f958ab40097ff199d467fc0e0dab5a6
Download: download sample
Signature CoinMiner
Create hunting rule
File size:19'174'808 bytes
First seen:2026-11-06 14:54:56 UTC
Last seen:2026-11-06 15:29:56 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash fd8bfaf89cc851deca8d547ef4f12f0e (6 x CoinMiner)
ssdeep 393216:Zs3A2eJTjrXmqqhMkLGLjPLGLjahBXmJk312eJTjrcP5:eAFBjr2qdKhJY1FBjrm
TLSH T185172305F75718DFD7268270256DB321FD2DEEA8A541CA3B9798863D3C72C6A28C43D2
TrID 45.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
18.0% (.EXE) Win64 Executable (generic) (6522/11/2)
13.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.6% (.ICL) Windows Icons Library (generic) (2059/9)
5.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon f8f0d4e8e8f0f070 (9 x CoinMiner)
Reporter adrian__luca
Tags:CoinMiner exe signed

Code Signing Certificate

Organisation:Google LLC
Issuer:Google LLC
Algorithm:sha256WithRSAEncryption
Valid from:2026-10-02T01:04:48Z
Valid to:2046-10-03T01:04:48Z
Serial number: 22d05bdb897b03dca8c1b7cc894d5ed2
Thumbprint Algorithm:SHA256
Thumbprint: 9ae0412485afcd450d95c4f0b414da0644c1e621b11d10b802cd7f8e31b716fb
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
161
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Malware family:
xmrig
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-06 16:57:03 UTC
Tags:
auto-reg miner stealer xmrig
Link:
https://app.any.run/tasks/76ee603c-7764-4285-a348-47798621d7c4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/97756/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af1b95d1492c978625a3984
Tags:
infosteal emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating synchronization primitives
Creating a file
Sending a custom TCP request
Creating a process from a recently created file
Creating a process with a hidden window
Searching for synchronization primitives
DNS request
Connecting to a cryptocurrency mining pool
Connection attempt
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Gathering data
Verdict:
Malicious
Labled as:
QD:Trojan.Astraea
Link:
https://www.hybrid-analysis.com/sample/62c8be142fb4b3b2e04dd92cb10b7a289f958ab40097ff199d467fc0e0dab5a6
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-02T23:51:00Z UTC
Last seen:
2026-10-15T23:36:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/62c8be142fb4b3b2e04dd92cb10b7a289f958ab40097ff199d467fc0e0dab5a6/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d198322a-3e2e-4050-bdf3-eaf9748c0d6e
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1999960
Signature
AI detected suspicious PE / MSI digital signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
DNS related to crypt mining pools
Found strings related to Crypto-Mining
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1999960 Sample: rcVoAXBVnx.exe Startdate: 06/11/2026 Architecture: WINDOWS Score: 100 50 xmr-eu1.nanopool.org 2->50 58 Malicious sample detected (through community Yara rule) 2->58 60 Antivirus detection for dropped file 2->60 62 Antivirus / Scanner detection for submitted sample 2->62 66 6 other signatures 2->66 7 rcVoAXBVnx.exe 12 15 2->7         started        11 GoogleWebBrowser.exe 2 8 2->11         started        13 ChromeUserAgent.exe 4 2->13         started        15 3 other processes 2->15 signatures3 64 DNS related to crypt mining pools 50->64 process4 file5 40 C:\Users\user\AppData\Local\...\gucache.dll, PE32+ 7->40 dropped 42 C:\Users\user\...behaviorgraphoogleWebBrowser.exe, PE32+ 7->42 dropped 44 C:\Users\user\...behaviorgraphoogleSyncMonitor.exe, PE32+ 7->44 dropped 46 4 other malicious files 7->46 dropped 68 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->68 17 GoogleCacheService.exe 7->17         started        21 rcVoAXBVnx.exe 5 12 7->21         started        24 GoogleSyncMonitor.exe 7->24         started        70 Antivirus detection for dropped file 11->70 72 Multi AV Scanner detection for dropped file 11->72 26 GoogleWebBrowser.exe 9 11->26         started        28 GoogleCacheService.exe 11->28         started        30 GoogleSyncMonitor.exe 11->30         started        signatures6 process7 dnsIp8 48 141.94.250.96, 10343, 49742 OVHFR France 17->48 52 Antivirus detection for dropped file 17->52 54 Multi AV Scanner detection for dropped file 17->54 56 Found strings related to Crypto-Mining 17->56 32 C:\ProgramDatabehaviorgraphoogle\Chrome\...\gucache.dll, PE32+ 21->32 dropped 34 C:\ProgramDatabehaviorgraphoogle\Chrome\...\chrmelf.dll, PE32+ 21->34 dropped 36 C:\ProgramDatabehaviorgraphoogle\...\ChromeUserAgent.exe, PE32+ 21->36 dropped 38 C:\...\ChromeUserAgent.exe:Zone.Identifier, ASCII 21->38 dropped file9 signatures10
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/40213f03b5d8e6900b3f9e7f68330605
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/62c8be142fb4b3b2e04dd92cb10b7a289f958ab40097ff199d467fc0e0dab5a6/
Threat name:
Win64.Coinminer.XMRig
Create hunting rule
Status:
Malicious
First seen:
2026-10-03 04:35:36 UTC
File Type:
PE+ (Exe)
Extracted files:
37
AV detection:
22 of 36 (61.11%)
Threat level:
  4/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mlel4fbpwsz3fycn3ewlcc32fcpzlcvuacl76gm5iz74byg2wwta._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery miner persistence
Link:
https://tria.ge/reports/261106-sartfazybx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Reads the TCP/IP host and domain name from the registry
Adds Run key to start application
Cryptocurrency Miner
Executes dropped EXE
Fake Chrome/Google updater delivering miners
Malware Family:
n/a
Verdict:
Malicious
Tags:
invalid_signature rat loader evasion
YARA:
Antivirus_strings BlacklistAnalysisTool win_token ParentProcessEvasion UNPROTECT_disable_process CreateService AutorunKey CreateScheduledTask
Link:
https://app.threat.zone/submission/2707f839-80d4-40df-a307-25ae551447ac
Malware Family:
astraea
Create hunting rule
Malicious:
True
Tags:
persistence overlay invalid-signature signed 64bits detect-debug-environment spreader
Link:
https://intel.virussign.com/intelligence/file/62c8be142fb4b3b2e04dd92cb10b7a289f958ab40097ff199d467fc0e0dab5a6
Unpacked files
SH256 hash:
62c8be142fb4b3b2e04dd92cb10b7a289f958ab40097ff199d467fc0e0dab5a6
MD5 hash:
40213f03b5d8e6900b3f9e7f68330605
SHA1 hash:
c150aa4547a4e89be94ff3fb8fa379b5ca6b4652
Link:
https://www.unpac.me/results/93663819-d08c-4be9-a802-e74f42b13f2b/
SH256 hash:
e9fbe124cba4a6729eddde4fea2a9d0508c43b0f0bdb0a729e882f407dd787cf
MD5 hash:
0ae5b2ec52e3b855b970ce2e8e5bd64f
SHA1 hash:
e53c478b6a09d9e545784adbf3ac0b24be443329
Link:
https://www.unpac.me/results/93663819-d08c-4be9-a802-e74f42b13f2b/
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/62c8be142fb4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/62c8be142fb4b3b2e04dd92cb10b7a289f958ab40097ff199d467fc0e0dab5a6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VIGIA_CoinMiner_0077e3b6
Create hunting rule
Author:VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:Miner dropper posing as Google Update Setup: Google LLC version info on a MinGW-w64 build (msvcrt imports, .xdata/.idata sections); real Google binaries are MSVC builds
Rule name:WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Fantom (pe, etat extrait)
Rule name:WIN_Malware_Havoc_ForgeAuto_99a4f65a
Create hunting rule
Author:Marjoriefort
Description:Detects Havoc (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_30f84f37
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_37b4704b
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/97756/

Comments