MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 842cd640dae0c4eae792cfa2057774bbef7ccfe94cc8bcf3b189dbc03370e2d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 842cd640dae0c4eae792cfa2057774bbef7ccfe94cc8bcf3b189dbc03370e2d2
SHA3-384 hash: e424ef83b1258fae58ea5d4bff175ceeebaf8ee9249d47c1c1708b96bd2489225f0aa6ad7e25bc6fc89aad9d209b5787
SHA1 hash: 601bc609b1ec105dfe3cd65d5880e440cb9c8121
MD5 hash: d7fc03db4dbafa9111ff068ea6abf692
humanhash: colorado-orange-low-friend
File name:file
Download: download sample
Signature CoinMiner
Create hunting rule
File size:2'602'496 bytes
First seen:2026-07-23 23:00:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cf923ad36f44d7b4d8b61ed873ea4dc7 (1 x CoinMiner)
ssdeep 49152:IM6Y/bKfQ7e6iOTJdEuHWtx9XRoJDFYT3bUWnCMsxhKXFTMU6t:IM6UbKfQ7eG3EuH8x9XRotFibUWnCMsV
TLSH T109C53358D3C1EF9FE36860FDC966A432B001A0615772F6EA7DD7C8BA97CD2851B39840
TrID 56.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
22.4% (.EXE) Win64 Executable (generic) (6522/11/2)
6.9% (.EXE) OS/2 Executable (generic) (2029/13)
6.8% (.EXE) Generic Win/DOS Executable (2002/3)
6.8% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter Bitsight
Tags:54e64e CoinMiner dropped-by-amadey exe


Avatar
Bitsight
url: http://91.92.242.236/files-129312398/files/file_6f8f3c0dc4813276.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
SilentCryptoMiner
Details
Link:
https://research.acce.ciphertechsolutions.com/results/8b6670e7-5238-4c58-af16-838cc8f1a850/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75861/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
Creating a service
Launching a service
Loading a system driver
Using the Windows Management Instrumentation requests
Query of malicious DNS domain
Enabling autorun for a service
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug crypto dropper
Link:
https://www.filescan.io/uploads/6a629d29de4ce0a4df8b5a94/reports/3739ea68-8258-424b-ab82-02b9db1d2059/overview
Verdict:
Malicious
Labled as:
Capa_contain_a_thread_local_storage___tls__section
Link:
https://www.hybrid-analysis.com/sample/842cd640dae0c4eae792cfa2057774bbef7ccfe94cc8bcf3b189dbc03370e2d2
Malware family:
XMRig Miner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4bad2863-0b2c-448b-a90e-1ce28dde2a65
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/842cd640dae0c4eae792cfa2057774bbef7ccfe94cc8bcf3b189dbc03370e2d2
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/842cd640dae0c4eae792cfa2057774bbef7ccfe94cc8bcf3b189dbc03370e2d2/
Threat name:
Win64.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-07-23 23:02:07 UTC
File Type:
PE+ (Exe)
AV detection:
24 of 36 (66.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qqwnmqg24dcovz4sz6rak53uxpxxzt7jjtelz45rrhn4am3q4lja._file
Verdict:
malicious
Label(s):
unc_loader_055
Create hunting rule
Link:
https://reports.threatray.com/0d5baf36-8564-48db-a0e3-20cc53f7a6e0
Similar samples:
1670daea2aae4a96521128c6448ddea99e5d51e45efa4919cdcb95eecd963eac
CoinMiner
1e9df0445cd8336e47ef1dba30c6d7556d368ddad8b536783ca83cc707899dd3
CoinMiner
2da4e452aef9094897e8face35805010b092d05049cde895b0fa0a679290605e
CoinMiner
2fa5db557d2570a7da19132facbd0c6c351d4714705f285b765ea9db86d7ff1e
CoinMiner
3774c53aca05c170b5c22c787e7693ae216af823426c3bf46a34043c809b602a
CoinMiner
502a4c498c1f14e9176959e54548f2af53a240eb9f769f11f9dfeeec7fc87b29
CoinMiner
842cd640dae0c4eae792cfa2057774bbef7ccfe94cc8bcf3b189dbc03370e2d2
CoinMiner
f8caf4ff7737a95efeafb2ca3b219a79afd39736b02289c38eca6f46860bc181
CoinMiner
fa054fe2eb1faf9f768ef8ff5aaf08f1a11072d25395f9353364390de9b4a8a4
CoinMiner
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig miner upx
Link:
https://tria.ge/reports/260723-2zfl5scp7w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
UPX packed file
XMRig Miner payload
Family: xmrig
Unpacked files
SH256 hash:
842cd640dae0c4eae792cfa2057774bbef7ccfe94cc8bcf3b189dbc03370e2d2
MD5 hash:
d7fc03db4dbafa9111ff068ea6abf692
SHA1 hash:
601bc609b1ec105dfe3cd65d5880e440cb9c8121
Link:
https://www.unpac.me/results/96f254c5-c79d-4226-ba61-14f2a709568a/
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/842cd640dae0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Windows_Generic_Threat_d331d190
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe 842cd640dae0c4eae792cfa2057774bbef7ccfe94cc8bcf3b189dbc03370e2d2

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/75861/

Comments