MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a927bcb779dc1d3bdeaf95d39f9c5802e2d649de1577c60adb786f64e888a54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 13

Intelligence 13 IOCs YARA 1 File information Comments

SHA256 hash:	8a927bcb779dc1d3bdeaf95d39f9c5802e2d649de1577c60adb786f64e888a54
SHA3-384 hash:	c1f6820927020ee7ee68bf108d6a0f560f869d3693bc0b2232e229fd4f1d1ecd025505f60b9be6f4e480145bec90e49f
SHA1 hash:	7fe2aa6bdc3d68f3d3f8b1db4e962874f81a45f9
MD5 hash:	5000695b684311fc7e1bb6960965fbf5
humanhash:	friend-lamp-friend-king
File name:	file
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	2'369'024 bytes
First seen:	2025-10-19 04:09:59 UTC
Last seen:	2025-10-19 06:18:08 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	49152:JWX6qiEDZqOsqtvvF1emWJ+LjcW+6WMOZURSg77M3ap:7uICtvDWJItlPH5
TLSH	T106B533A1C9798485EC47CC7217E11A07E771F462E7F7A98F33946EB41208BE0C9A57B8
TrID	22.5% (.ICL) Windows Icons Library (generic) (2059/9) 22.2% (.EXE) DOS Executable Borland Pascal 7.0x (2035/25) 21.8% (.EXE) Generic Win/DOS Executable (2002/3) 21.8% (.EXE) DOS Executable Generic (2000/1) 11.0% (.SCORE) Music Craft Score (1007/6)
Magika	pebin
Reporter	Bitsight
Tags:	CoinMiner dropped-by-amadey exe

Bitsight

url: http://178.16.55.189/files/6260444824/aJFTrRr.exe

Intelligence

File Origin

# of uploads :

# of downloads :

101

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2025-10-19 04:13:11 UTC

Tags:

miner auto-sch

Link:

https://app.any.run/tasks/c8bb26a1-be74-403f-ba6e-8f06a76a6cf1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/33304/

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68f464d46dc4a08515e307f8

Tags:

autorun xmrig

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Launching a process

Creating a process with a hidden window

Сreating synchronization primitives

Searching for synchronization primitives

Connection attempt

Sending a custom TCP request

Launching the default Windows debugger (dwwin.exe)

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed packed packer_detected

Link:

https://www.filescan.io/uploads/68f464cbc85c5c56972dd234/reports/b3e66dab-efc2-436c-8a76-e2def8d01caa/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/8a927bcb779dc1d3bdeaf95d39f9c5802e2d649de1577c60adb786f64e888a54

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-10-19T01:24:00Z UTC

Last seen:

2025-10-19T12:04:00Z UTC

Hits:

~100

Detections:

Trojan.Win64.Agentb.sb Trojan.Win32.Shellcode.gmc Trojan.Win32.Agent.sb Trojan.Win32.Shellcode.sb VHO:Trojan-Ransom.Win32.Blocker.gen Trojan.Win64.Miner.sb Trojan.Win32.CoinMiner.sb PDM:Trojan.Win32.Tasker.cust PDM:Trojan.Win32.Generic not-a-virus:RiskTool.Win64.XMRigMiner.a RiskTool.BitCoinMiner.TCP.C&C not-a-virus:RiskTool.Win32.Miner.sb

Link:

https://opentip.kaspersky.com/8a927bcb779dc1d3bdeaf95d39f9c5802e2d649de1577c60adb786f64e888a54/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/7d563d88-bb49-41a9-9afa-5f8a114e1de7

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8a927bcb779dc1d3bdeaf95d39f9c5802e2d649de1577c60adb786f64e888a54

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/5000695b684311fc7e1bb6960965fbf5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8a927bcb779dc1d3bdeaf95d39f9c5802e2d649de1577c60adb786f64e888a54/

Verdict:

Malicious

Threat:

Trojan.Win32.Shellcode

Link:

https://tip.neiki.dev/file/8a927bcb779dc1d3bdeaf95d39f9c5802e2d649de1577c60adb786f64e888a54

Threat name:

Win64.Trojan.Amadey

Status:

Suspicious

First seen:

2025-10-19 04:11:42 UTC

File Type:

PE+ (Exe)

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rkjhxs3xtxa5hppk7fott6ofqaxc2ze54flxyyfnw6dpmtuirjka._file

Verdict:

malicious

Label(s):

coinminer

Similar samples:

error

CoinMiner

Result

Malware family:

n/a

Score:

7/10

Tags:

execution persistence

Link:

https://tria.ge/reports/251019-erx5wszlb1/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Adds Run key to start application

Executes dropped EXE

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/24aa3b6d-c6ba-458b-8d72-5b6a8d5fca2e

Unpacked files

SH256 hash:

8a927bcb779dc1d3bdeaf95d39f9c5802e2d649de1577c60adb786f64e888a54

MD5 hash:

5000695b684311fc7e1bb6960965fbf5

SHA1 hash:

7fe2aa6bdc3d68f3d3f8b1db4e962874f81a45f9

Link:

https://www.unpac.me/results/c99b2c4d-46b8-4ec0-98bd-56ef83391a48/

Malware family:

XMRig

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8a927bcb779d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/8a927bcb779dc1d3bdeaf95d39f9c5802e2d649de1577c60adb786f64e888a54

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.