MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91781da6c1db66ebd379e2008b897729ef011d064770a50d3acdaf01f2e95850. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91781da6c1db66ebd379e2008b897729ef011d064770a50d3acdaf01f2e95850
SHA3-384 hash: 06f4b6860b8a15ba7830ece042fe926e23ef8f3ada4b48ccdc05fb6e9986d2729076982893b1fc6abf637cc3e1a0b38f
SHA1 hash: e25d3292f1926dd4e3a045e77f3b2b4ede3d9691
MD5 hash: 0e9b3120bc58a577668e7bd8ce5e72b7
humanhash: sierra-berlin-jig-florida
File name:Printer_Driver_SSL_support_v43.22.209.99.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:4'816'136 bytes
First seen:2026-01-10 13:03:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f6baa5eaa8231d4fe8e922a2e6d240ea (60 x CoinMiner, 22 x DCRat, 15 x LummaStealer)
ssdeep 98304:No53bsjzySvReBp8X+Ujxh+VrfFAMk1TyHr9lj1uVx+/VMB9iTJzuRR5V0Pm:NoxCXeBmX+EX4fyMk1crXc3+iB4VcR53
Threatray 1'160 similar samples on MalwareBazaar
TLSH T1AF263303AD94E1F0DAE05B7F2188F1D206FBFA241B5591E7AF9005350EB69FA523D09E
TrID 38.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
24.6% (.EXE) Win64 Executable (generic) (10522/11/4)
11.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.5% (.EXE) Win32 Executable (generic) (4504/4/1)
4.7% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter burger
Tags:CoinMiner exe signed

Code Signing Certificate

Organisation:FileZilla FTP Client
Issuer:FileZilla FTP Client
Algorithm:sha256WithRSAEncryption
Valid from:2025-12-24T00:00:00Z
Valid to:2030-12-24T00:00:00Z
Serial number: 3010edb326dc0f81
Intelligence: 14 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: c3bdb12dd0565b796cab743ef8c6fab84e7a2d25d38f58a3e5a71a797a648feb
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
xmrig
Create hunting rule
ID:
1
File name:
Printer_Driver_SSL_support_v43.22.209.99.exe
Verdict:
Malicious activity
Analysis date:
2026-01-10 13:02:56 UTC
Tags:
arch-exec pastebin silentcryptominer winring0-sys vuln-driver hijackloader upx xmrig
Link:
https://app.any.run/tasks/f518b788-3696-431f-9007-51ac2d6a772f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/48468/
Detection(s):
Win.Malware.7zip-10013374-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69624dfef50945831dffb113
Tags:
dropper virus sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Enabling the 'hidden' option for files in the %temp% directory
Running batch commands
Creating a process with a hidden window
Launching a process
Moving a file to the %temp% subdirectory
Creating a process from a recently created file
Replacing files
Сreating synchronization primitives
Adding an exclusion to Microsoft Defender
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context fingerprint installer installer installer-heuristic keylogger microsoft_visual_cc obfuscated overlay signed stealer
Link:
https://www.filescan.io/uploads/69624e2407ef5fa68e83b627/reports/d1082075-26e1-4bef-9949-6227482313a7/overview
Verdict:
Malicious
Labled as:
Malware.7zip
Link:
https://www.hybrid-analysis.com/sample/91781da6c1db66ebd379e2008b897729ef011d064770a50d3acdaf01f2e95850
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-10T10:05:00Z UTC
Last seen:
2026-01-11T02:00:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.SFX.sb Trojan.Win32.Reconyc.sb Trojan.Win32.Inject.sb Trojan.Win32.Agent.rnd HEUR:Trojan.Win32.SFX.gen Trojan-Dropper.Win32.Agent.sb Trojan.Win32.Miner.sb Trojan.Win32.Agent.sb HEUR:Trojan.Win64.Reflo.pef PDM:Trojan.Win32.Generic RiskTool.BitCoinMiner.TCP.C&C
Link:
https://opentip.kaspersky.com/91781da6c1db66ebd379e2008b897729ef011d064770a50d3acdaf01f2e95850/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c3c0f038-c0df-4bbe-92ee-edbbb456bebf
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
spyw.evad.troj.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1847916
Signature
Adds a directory exclusion to Windows Defender
AI detected suspicious PE digital signature
Changes security center settings (notifications, updates, antivirus, firewall)
Connects to a pastebin service (likely for C&C)
Contains functionality to register a low level keyboard hook
Drops password protected ZIP file
Drops PE files with benign system names
Found strings related to Crypto-Mining
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample is not signed and drops a device driver
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Stop EventLog
Sigma detected: System File Execution Location Anomaly
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1847916 Sample: Printer_Driver_SSL_support_... Startdate: 10/01/2026 Architecture: WINDOWS Score: 100 91 pastebin.com 2->91 97 Suricata IDS alerts for network traffic 2->97 99 Malicious sample detected (through community Yara rule) 2->99 101 Multi AV Scanner detection for submitted file 2->101 105 9 other signatures 2->105 10 Printer_Driver_SSL_support_v43.22.209.99.exe 8 2->10         started        14 lhhsgwktkatl.exe 2->14         started        16 svchost.exe 2->16         started        18 4 other processes 2->18 signatures3 103 Connects to a pastebin service (likely for C&C) 91->103 process4 file5 83 C:\Users\user\AppData\Local\Temp\...\7z.exe, PE32+ 10->83 dropped 85 C:\Users\user\AppData\Local\Temp\...\main.bat, Unicode 10->85 dropped 87 C:\Users\user\AppData\Local\Temp\...\7z.dll, PE32+ 10->87 dropped 121 Contains functionality to register a low level keyboard hook 10->121 20 cmd.exe 2 10->20         started        89 C:\Windows\Temp\lheoowadpipl.sys, PE32+ 14->89 dropped 123 Modifies the context of a thread in another process (thread injection) 14->123 125 Adds a directory exclusion to Windows Defender 14->125 127 Sample is not signed and drops a device driver 14->127 22 conhost.exe 14->22         started        26 powershell.exe 14->26         started        28 cmd.exe 14->28         started        32 6 other processes 14->32 129 Changes security center settings (notifications, updates, antivirus, firewall) 16->129 30 MpCmdRun.exe 16->30         started        signatures6 process7 dnsIp8 34 svchost.exe 1 2 20->34         started        38 7z.exe 2 20->38         started        40 conhost.exe 20->40         started        50 6 other processes 20->50 93 185.107.74.85, 3333, 49695, 49697 AIREEIPv4RU01UpstreamRTCOMMRU Russian Federation 22->93 95 pastebin.com 104.20.29.150, 443, 49696 CLOUDFLARENETUS United States 22->95 115 Found strings related to Crypto-Mining 22->115 117 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 22->117 119 Loading BitLocker PowerShell Module 26->119 42 conhost.exe 26->42         started        44 conhost.exe 28->44         started        46 wusa.exe 28->46         started        48 conhost.exe 30->48         started        52 5 other processes 32->52 signatures9 process10 file11 79 C:\ProgramData\...\lhhsgwktkatl.exe, PE32+ 34->79 dropped 107 Adds a directory exclusion to Windows Defender 34->107 54 powershell.exe 23 34->54         started        57 cmd.exe 1 34->57         started        59 sc.exe 1 34->59         started        61 8 other processes 34->61 109 Drops PE files with benign system names 38->109 111 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 40->111 81 C:\Users\user\AppData\Local\...\svchost.exe, PE32+ 50->81 dropped signatures12 process13 signatures14 113 Loading BitLocker PowerShell Module 54->113 63 conhost.exe 54->63         started        65 conhost.exe 57->65         started        67 wusa.exe 57->67         started        69 conhost.exe 59->69         started        71 conhost.exe 61->71         started        73 conhost.exe 61->73         started        75 conhost.exe 61->75         started        77 5 other processes 61->77 process15
Score:
57%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/91781da6c1db66ebd379e2008b897729ef011d064770a50d3acdaf01f2e95850
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout SFX 7z Win 32 Exe x86
Link:
https://app.malva.re/file/0e9b3120bc58a577668e7bd8ce5e72b7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/91781da6c1db66ebd379e2008b897729ef011d064770a50d3acdaf01f2e95850/
Verdict:
Malicious
Threat:
Family.HIJACKLOADER
Link:
https://tip.neiki.dev/file/91781da6c1db66ebd379e2008b897729ef011d064770a50d3acdaf01f2e95850
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sf4b3jwb3ntoxu3z4iaixclxfhxqchigi5ykkdj2zwxqd4xjlbia._file
Verdict:
malicious
Label(s):
unc_loader_055
Create hunting rule
Similar samples:
030341b8ce7dfcd95d3918808fbc8b6f3b540457c2c02a916afe012c4a4fd76f
CoinMiner
192c8d839f8bb794a6c4d07f98ebd71517d79e12974371130829de1ec61c3c5a
CoinMiner
1fbb7cc796ed31d975e436f3e164633914fccdaaeb5da6075862d87e3601dc33
CoinMiner
3006fbf4ad07f754a252a2d65bbd1df77abdd9361bcc53d8705ab18b6dcecc0f
CoinMiner
7aa20099672e8dc0f13bde889491b9db5f38b58a1a3bb80e39b17689cc512e00
CoinMiner
a509d90eaa00df8640c180439726fc0ed487dc30d236e19d1fc1514782e23671
CoinMiner
cfbf75c729655bd23b26df184d5091bcd0a5227b165f86a335150477e6af7237
CoinMiner
error
CoinMiner
+ 1'150 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig defense_evasion discovery execution miner persistence upx
Link:
https://tria.ge/reports/260110-qanqnsgz5e/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
UPX packed file
Contacts third-party web service commonly abused for C2
Checks computer location settings
Creates new service(s)
Executes dropped EXE
Loads dropped DLL
Stops running service(s)
Command and Scripting Interpreter: PowerShell
XMRig Miner payload
Xmrig family
xmrig
Verdict:
Malicious
Tags:
Win.Malware.7zip-10013374-0
YARA:
n/a
Link:
https://app.threat.zone/submission/19efb146-cf05-4635-8572-d25cf2bd04bc
Unpacked files
SH256 hash:
91781da6c1db66ebd379e2008b897729ef011d064770a50d3acdaf01f2e95850
MD5 hash:
0e9b3120bc58a577668e7bd8ce5e72b7
SHA1 hash:
e25d3292f1926dd4e3a045e77f3b2b4ede3d9691
Link:
https://www.unpac.me/results/7f9a6696-c416-4eae-825c-9da8a2f3ae85/
SH256 hash:
0ff5eac5ea3da2eb72d6a6e7c4b7de1a0e9727d525d2e6a5c705a8f14980af01
MD5 hash:
b9dc8e6d402ae8d3de5da30afb77aba6
SHA1 hash:
fce270c040941485f9abe565466cd2f1b891a4d8
Link:
https://www.unpac.me/results/7f9a6696-c416-4eae-825c-9da8a2f3ae85/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/91781da6c1db/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/91781da6c1db66ebd379e2008b897729ef011d064770a50d3acdaf01f2e95850

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

SalatStealer

Executable exe f0bed15538e01b50c19ae3e088d47786654370a1878ee9326ca5f5950ef9bc46

CoinMiner

Executable exe 91781da6c1db66ebd379e2008b897729ef011d064770a50d3acdaf01f2e95850

(this sample)

  
Dropped by
SHA256 f0bed15538e01b50c19ae3e088d47786654370a1878ee9326ca5f5950ef9bc46
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/48468/
  
Dropped by
MD5 9afd22a4677e377b59db24a583efc56f

Comments