🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74e87fa2a30a457be066f70b4a47ba63483e17ebaaa7bbb23cfe0e8f376ba469. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 8


Intelligence 8 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74e87fa2a30a457be066f70b4a47ba63483e17ebaaa7bbb23cfe0e8f376ba469
SHA3-384 hash: 5227c7fa09b70cb12bfc09386f3ed23282b8a92d84e0e3ff769579ef006644cad9c43a94d18226e2dfb57e2fd6e171c0
SHA1 hash: 5aeddad642aff622e534c7b25d9cfe0cc94615b9
MD5 hash: bc8742c65b45c822b03bd394516df791
humanhash: summer-pennsylvania-missouri-spring
File name:74e87fa2a30a457be066f70b4a47ba63483e17ebaaa7bbb23cfe0e8f376ba469
Download: download sample
Signature CoinMiner
Create hunting rule
File size:5'071'736 bytes
First seen:2026-10-25 08:54:03 UTC
Last seen:2026-10-25 09:03:51 UTC
File type: gz
MIME type:application/gzip
ssdeep 98304:OYlxJGlcp86LJpXXcLwuns67WeLpYc+EFYoImrzap7aKm51pGg7gDMfTZvV:OYlxJGmp86ruwunp7LSc+xoF/aJaKm5H
TLSH T1023633B8EB40AD0353CC148B84938ACD00879ED7574C7417299DB8CEE99EBC5EBDA758
Magika gzip
Reporter stackworks
Tags:CoinMiner cowrie gz gzip Outlaw

Intelligence

File Origin
# of uploads :
3
# of downloads :
17
Origin country :
RU RU
File Archive Information

This file archive contains 17 file(s), sorted by their relevance:

File name:run
File size:376 bytes
SHA256 hash: 289dfa1a65739556b5c90e844d558726b070350aefcad15b11bf83f969472c09
MD5 hash: e757884c25e6b616f2b636925ffc5026
MIME type:text/x-shellscript
Signature CoinMiner
File name:init
File size:967 bytes
SHA256 hash: 658040b1789b15e9ba238bae6520fc0cdcd7eebbdbda3774aef176790c6a2eab
MD5 hash: 7151baf2c01a76581e0f816c7f91de7e
MIME type:text/plain
Signature CoinMiner
File name:kthreadadd
File size:216 bytes
SHA256 hash: d6228ada864c88960c9b7f7d527f831ad7440daff4be455d895f4ad15d62223e
MD5 hash: 3a684fd75149823a983b121d7b4a22a2
MIME type:text/x-shellscript
Signature CoinMiner
File name:crond
File size:2'781'976 bytes
SHA256 hash: 2ab4da58efa51dadd0787a32b44cf8533d3d3a7bc1788123c112dcb267821030
MD5 hash: 531527ac24a1501cb39959c10a04a79b
MIME type:application/x-executable
Signature CoinMiner
File name:kthreadadd64
File size:1'145'176 bytes
SHA256 hash: 94d45a4da52d0b4593387673b8579892c866b19d71408dde550800050a3d65b8
MD5 hash: a803de211bbdc0dfae46c5e2af7b2591
MIME type:application/x-executable
Signature CoinMiner
File name:delsshd
File size:1'543 bytes
SHA256 hash: e450d3eb9d15c8585e776eabbec02fb6286e8738f9ef200746322da2f66fed93
MD5 hash: c26752eb21cd360070f2b757963a2fe2
MIME type:text/plain
Signature CoinMiner
File name:stop
File size:1'253 bytes
SHA256 hash: 767db73de8cbe6bf2ca192ef5730c70c1d3a9f1e4e783d5f3d8df2c52bc4fb5c
MD5 hash: df9471e0f14d5c6ee60768ae5cecb209
MIME type:text/x-shellscript
Signature CoinMiner
File name:init01
File size:9'389 bytes
SHA256 hash: 82eba36c8ac1613f451333eae4bff558e53cf814938d4b181790644371400eec
MD5 hash: e8ffc6aac5c2784b10319c25d229a44e
MIME type:text/x-shellscript
Signature CoinMiner
File name:init2
File size:713 bytes
SHA256 hash: 07e3060d67a7afb8a6ce14ca4e183bfa9436a28d2608b4e736a1278fd7a7d447
MD5 hash: f34e5bdf60d3c86facf84d899b6ae974
MIME type:text/plain
Signature CoinMiner
File name:a
File size:6'571 bytes
SHA256 hash: c8913c895f8ae2fc1ec6162850c0843f875f7882b6742550d68b101cbf662898
MD5 hash: 69c7923ed59fb2c2b98952e2388c152b
MIME type:text/x-shellscript
Signature CoinMiner
File name:kthreadadd32
File size:1'170'868 bytes
SHA256 hash: 289abf2d87fb23983de053535a7e2946a90865c2d96f80f94f491e28c388fb1f
MD5 hash: 2d9562fe6d78e5eb5932e9f827a21385
MIME type:application/x-executable
Signature CoinMiner
File name:go
File size:1'030 bytes
SHA256 hash: 4c9a37391ad2dcd1d8403ffe3cbc7c21899364c68b251a9692efb5eac588b1c1
MD5 hash: 7ea7e3a9597b233f4a197335ca37b10d
MIME type:text/x-shellscript
Signature CoinMiner
File name:rmkwork
File size:2'121 bytes
SHA256 hash: efa6d7375136e09ed7e0116f33d63ae34f480ebeaac82bdb1d11190714e6c793
MD5 hash: 93556f520cced7aaabbf4cf7dc066e57
MIME type:text/x-shellscript
Signature CoinMiner
File name:init02
File size:4'034 bytes
SHA256 hash: 6c1831216e42bd6f907e5f0f07a4c23e9e047dba3ca943fa7fe304d318c2555d
MD5 hash: 6929b19efca6d8371db14062d4535964
MIME type:text/x-shellscript
Signature CoinMiner
File name:initall
File size:193 bytes
SHA256 hash: 4a126e7fbd235ceda41d0e0c89dd43af6008a025681e74fc39c24cbf3050a6f9
MD5 hash: 569cb7206b83d666f77d50610c7b969f
MIME type:text/x-shellscript
Signature CoinMiner
File name:start
File size:203 bytes
SHA256 hash: 9dbbc9b5d7793425968e42e995226c5f9fe32e502a0a694320a5e838d57c8836
MD5 hash: ffd387bdf3adab8969941693d3a86ee7
MIME type:text/x-shellscript
Signature CoinMiner
File name:clean.sh
File size:8'201 bytes
SHA256 hash: 486d24d4c640561478f4bdf813b208e04d483e11ba3f4306275f3655356e2762
MD5 hash: d49d1d183a20fb5a5faf51bad349f620
MIME type:text/x-shellscript
Signature CoinMiner
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Downloader-ADK.73226495.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.BV.Miner-ML.86921282.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.Tool.Linux.BtcMine.4877.24977.29603.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Python.Agent-BN.13321.10513.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Python.Agent-BN.16511.12341.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Python.Agent-BN.17669.869.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Python.Agent-BN.4957.5513.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Linux.Agent.AJP.71124641.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Linux.Agent.AKV.82923287.UNOFFICIAL
Create hunting rule

YARA.SIGNATURE_BASE_SUSP_LNX_Linux_Malware_Indicators_Aug20_1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac1cc91607b9f5856d740bd
Tags:
virus
Verdict:
Suspicious
Labled as:
Trojan.PY.Agent
Link:
https://www.hybrid-analysis.com/sample/74e87fa2a30a457be066f70b4a47ba63483e17ebaaa7bbb23cfe0e8f376ba469
Verdict:
Malicious
File Type:
gz
First seen:
2026-09-21T11:38:00Z UTC
Last seen:
2026-10-26T18:37:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/74e87fa2a30a457be066f70b4a47ba63483e17ebaaa7bbb23cfe0e8f376ba469/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/74e87fa2a30a457be066f70b4a47ba63483e17ebaaa7bbb23cfe0e8f376ba469
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Elf Executable Executable GZip Archive
Link:
https://app.malva.re/file/bc8742c65b45c822b03bd394516df791
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/74e87fa2a30a457be066f70b4a47ba63483e17ebaaa7bbb23cfe0e8f376ba469/
Threat name:
Linux.Hacktool.SshBrute
Create hunting rule
Status:
Malicious
First seen:
2026-09-21 17:31:07 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
16 of 24 (66.67%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=otuh7ivdbjcxxydg64fuur52mned4f7lvkt3xmr47yhi6n3luruq._file
Result
Malware family:
xmrig_linux
Create hunting rule
Score:
  10/10
Tags:
family:xmrig family:xmrig_linux antivm defense_evasion discovery linux miner persistence privilege_escalation rootkit upx
Link:
https://tria.ge/reports/261025-m8r9zaft3w/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads CPU attributes
Checks hardware identifiers (DMI)
Enumerates running processes
Reads hardware information
Removes the immutable protection flag from a file
Write file to user bin folder
File and Directory Permissions Modification
Executes dropped EXE
Loads a kernel module
XMRig Miner payload
Family: xmrig
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.23
Link:
https://yomi.yoroi.company/submissions/74e87fa2a30a457be066f70b4a47ba63483e17ebaaa7bbb23cfe0e8f376ba469

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Linux_Trojan_Kinsing_7cdbe9fa
Create hunting rule
Author:Elastic Security
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:SUSP_ELF_LNX_UPX_Compressed_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspicious ELF binary with UPX compression
Reference:Internal Research
Rule name:SUSP_LNX_Linux_Malware_Indicators_Aug20_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects indicators often found in linux malware samples. Note: This detection is based on common characteristics typically associated with the mentioned threats, must be considered a clue and does not conclusively prove maliciousness.
Reference:Internal Research
Rule name:SUSP_LNX_Linux_Malware_Indicators_Aug20_1_RID3621
Create hunting rule
Author:Florian Roth
Description:Detects indicators often found in linux malware samples
Reference:Internal Research
Rule name:SUSP_Websites
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference of suspicious sites that might be used to download further malware
Rule name:test_rule_vldslv
Create hunting rule
Rule name:TH_Generic_MassHunt_Linux_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Linux malware mass-hunt rule - 2026
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:UPXProtectorv10x2
Create hunting rule
Author:malware-lu
Rule name:upx_packed_elf_v1
Create hunting rule
Author:RandomMalware
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments