MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b7c767694aa1cdf7429f364c0c104b32f738203c8c60b5f25a6e2f6a66a71fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 20


Intelligence 20 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b7c767694aa1cdf7429f364c0c104b32f738203c8c60b5f25a6e2f6a66a71fa
SHA3-384 hash: a44d2ea52afefeff7e27c8a853c04b64807e665d7a084b8fd0c286540f91edd91ced81d484aca7fbab1ea7056c6c1bb2
SHA1 hash: 48edac0f38ebf625a559bbd8771cf824777099c8
MD5 hash: f4c9005c80304cf865ebaad861d18bfe
humanhash: vegan-london-may-spaghetti
File name:file
Download: download sample
Signature CoinMiner
Create hunting rule
File size:81'408 bytes
First seen:2026-01-16 08:30:06 UTC
Last seen:2026-01-18 14:23:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash cd8f53456e8eab6877bd6db17a9de950 (1 x Phorpiex, 1 x CoinMiner)
ssdeep 1536:zUAxGlZFmav82V/Bln8YfBZhobS7I5F/LJw86cnMpqFa:oAo8Od/Xn8Y3h++I5tJv6GmqFa
TLSH T11F834A10F6C0863AF0F700FBD2FB166A5D2CEFB4530654E75391A9AF6B249C0A93156B
TrID 33.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
21.3% (.EXE) Win64 Executable (generic) (10522/11/4)
13.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter Bitsight
Tags:CoinMiner dropped-by-phorpiex exe


Avatar
Bitsight
url: http://195.178.136.19/forg

Intelligence

File Origin
# of uploads :
4
# of downloads :
184
Origin country :
SG SG
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/fe6cd157-942d-4079-ad57-4d40d9ffe5cc/
Malware family:
phorpiex
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2026-01-16 08:32:37 UTC
Tags:
auto-reg phorpiex botnet
Link:
https://app.any.run/tasks/009f4604-f743-4172-9743-f8812846933a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Phorpiex
Create hunting rule
Link:
https://www.capesandbox.com/analysis/49066/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6969f73aef906a21abcdb089
Tags:
phishing spam
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
babar crypto explorer fingerprint lolbin microsoft_visual_cc phorpiex
Link:
https://www.filescan.io/uploads/6969f7353dd9d2095056cf6e/reports/84cbde0f-05fb-4b40-99f3-e6cbc39bfdc1/overview
Verdict:
Malicious
Labled as:
Adware.babar.Generic
Link:
https://www.hybrid-analysis.com/sample/6b7c767694aa1cdf7429f364c0c104b32f738203c8c60b5f25a6e2f6a66a71fa
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-16T05:39:00Z UTC
Last seen:
2026-01-18T06:24:00Z UTC
Hits:
~1000
Detections:
Trojan.Agentb.UDP.C&C BSS:Trojan.Win32.Generic Trojan.Win32.Agent.sb HEUR:Worm.Win32.Generic HEUR:Trojan-Banker.Win32.Phorpiex.gen HEUR:Trojan.Win32.Agent.gen Trojan-Dropper.Win32.Phorpiex.sb Trojan-Dropper.Win32.Dorifel.sbc Trojan-Banker.Win32.ClipBanker.sb Trojan.Win32.Zonidel.sb HEUR:Trojan-Downloader.Win32.Adload.vho
Link:
https://opentip.kaspersky.com/6b7c767694aa1cdf7429f364c0c104b32f738203c8c60b5f25a6e2f6a66a71fa/results?tab=lookup
Malware family:
Phorpiex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/945c78f8-cd00-4188-b747-6a66a8a18abd
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6b7c767694aa1cdf7429f364c0c104b32f738203c8c60b5f25a6e2f6a66a71fa
Gathering data
Detection:
phorpiex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6b7c767694aa1cdf7429f364c0c104b32f738203c8c60b5f25a6e2f6a66a71fa/
Verdict:
Malicious
Threat:
Family.PHORPIEX
Link:
https://tip.neiki.dev/file/6b7c767694aa1cdf7429f364c0c104b32f738203c8c60b5f25a6e2f6a66a71fa
Threat name:
Win32.Worm.Phorpiex
Create hunting rule
Status:
Malicious
First seen:
2026-01-16 08:30:49 UTC
File Type:
PE (Exe)
AV detection:
27 of 38 (71.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nn6hm5uuvion65bj6nsmbqiewmxxhaqdzddawxzfu3rpnjtkoh5a._file
Verdict:
malicious
Label(s):
phorpiex
Create hunting rule
Similar samples:
error
CoinMiner
Result
Malware family:
phorphiex
Create hunting rule
Score:
  10/10
Tags:
family:phorphiex discovery loader persistence spyware stealer trojan worm
Link:
https://tria.ge/reports/260116-keka6abt2h/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Drops file in Windows directory
Adds Run key to start application
Executes dropped EXE
Reads user/profile data of web browsers
Phorphiex family
Phorphiex payload
Phorphiex, Phorpiex
Malware Config
C2 Extraction:
http://178.16.54.109/
http://195.178.136.19/
178.16.54.109
Verdict:
Malicious
Tags:
Win32_Phorpiex
YARA:
n/a
Link:
https://app.threat.zone/submission/6f64fba5-29b0-413b-93c4-5c7ce831a476
Unpacked files
SH256 hash:
6b7c767694aa1cdf7429f364c0c104b32f738203c8c60b5f25a6e2f6a66a71fa
MD5 hash:
f4c9005c80304cf865ebaad861d18bfe
SHA1 hash:
48edac0f38ebf625a559bbd8771cf824777099c8
Link:
https://www.unpac.me/results/9bb5516d-72ad-40d1-b519-e84b68a2e64e/
Malware family:
Phorpiex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6b7c767694aa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Phorpiex
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/6b7c767694aa1cdf7429f364c0c104b32f738203c8c60b5f25a6e2f6a66a71fa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 6b7c767694aa1cdf7429f364c0c104b32f738203c8c60b5f25a6e2f6a66a71fa

(this sample)

  
Dropped by
Phorpiex
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/49066/

Comments