MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aeee59e8cbfa37cd0336e595a0e6b3b3cd59323c87a1d603fcde358491001c8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 8

Intelligence 8 IOCs YARA 5 File information Comments

SHA256 hash:	aeee59e8cbfa37cd0336e595a0e6b3b3cd59323c87a1d603fcde358491001c8a
SHA3-384 hash:	4679a90122872c2dba1db4e0b6f7977523c7f938a20722fa399c2f370a4f211f77a4f663da4acde328f3a355635a1ad8
SHA1 hash:	bc12e43280b90a7d0164eae2e6eadfaa45883308
MD5 hash:	9b6590df2a1a43cf72e0b02a1e9a4c07
humanhash:	edward-alaska-jersey-mountain
File name:	aeee59e8cbfa37cd0336e595a0e6b3b3cd59323c87a1d603fcde358491001c8a.exe
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	5'244'928 bytes
First seen:	2026-09-04 08:17:37 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	949ec789a5933fb6051c9013a550fb57 (39 x CoinMiner)
ssdeep	98304:YoDJvHVGveO7LMo0nl21+Wez1QwLE37HqtxkpYSHpsFpjN6agGgX+S:ND9Hgbv0mnwQHfHapjNgGtS
TLSH	T12B3633CB28D290B1F066CBB8964BB1BEB13A7BE546747C12B7CD0908CE5BE04593D395
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	whack_sh
Tags:	CoinMiner exe whack.sh

Intelligence

File Origin

# of uploads :

# of downloads :

185

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b8758f4a-599b-40ac-ab38-123db1151f1d/

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-04 08:18:44 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b289b6d3-39d1-4ea5-b54f-352cc9253054

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/83859/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Launching a process

Creating a process with a hidden window

Creating a service

Launching a service

Creating a process from a recently created file

Creating a file in the Windows subdirectories

Deleting a recently created file

Using the Windows Management Instrumentation requests

Creating a file in the system32 subdirectories

Searching for synchronization primitives

Enabling autorun for a service

Moving of the original file

Unauthorized injection to a system process

Adding an exclusion to Microsoft Defender

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6a9a7ec67ad4c53e66e2dc2f/reports/0e43d446-0470-440b-a4b0-29d42831b3a5/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/aeee59e8cbfa37cd0336e595a0e6b3b3cd59323c87a1d603fcde358491001c8a

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/b0c79ba0-9bae-4ee6-8a22-cad6cbf5c7b0

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/aeee59e8cbfa37cd0336e595a0e6b3b3cd59323c87a1d603fcde358491001c8a

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aeee59e8cbfa37cd0336e595a0e6b3b3cd59323c87a1d603fcde358491001c8a/

Gathering data

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=v3xft2gl7i342azw4wk2bzvtwpgvsmr4q6q5ma743y2yjeiadsfa._file

Unpacked files

SH256 hash:

aeee59e8cbfa37cd0336e595a0e6b3b3cd59323c87a1d603fcde358491001c8a

MD5 hash:

9b6590df2a1a43cf72e0b02a1e9a4c07

SHA1 hash:

bc12e43280b90a7d0164eae2e6eadfaa45883308

Link:

https://www.unpac.me/results/231e3f63-1355-4184-ad3b-c3ac9917401c/

Malware family:

XMRig

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/aeee59e8cbfa/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)