MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1f1fe9eaa28a32efb48a7a70a40ff7e5fcf7e633081ee65713833e5f695ebd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 9

Intelligence 9 IOCs YARA 7 File information Comments

SHA256 hash:	b1f1fe9eaa28a32efb48a7a70a40ff7e5fcf7e633081ee65713833e5f695ebd5
SHA3-384 hash:	958f05ca5613badb25606a470340d8ff063d242e7343d025ca947e6da8e02f9a2b46c9a42f7509168ef575e454660d40
SHA1 hash:	b13cadbdd686db4a80445d6413708bdf2c5e6be4
MD5 hash:	c04f0dc1cbefd3b345496edbd7cdfbc5
humanhash:	dakota-leopard-quiet-seven
File name:	file
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	649'728 bytes
First seen:	2026-09-27 19:11:06 UTC
Last seen:	2026-09-28 11:50:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d4be1c346b5a7faec79f8b76f44d60fd (1 x CoinMiner)
ssdeep	12288:Z9b38YTm053irTnd8sMPStU8SBpCPMO+amm6Tp7PvL+O/QkEoPbPVOC:ZZ35WrTnCsMPeSBpCLIlKhkEoPT0C
TLSH	T10ED4E132B6ABC1ADC5224A37D0305341B7E1F482CE717FEF15522A713EA68C95B39792
TrID	51.9% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	Bitsight
Tags:	c CoinMiner dropped-by-gcleaner exe PMIX0.file

Bitsight

url: http://91.92.242.236/service

Intelligence

File Origin

# of uploads :

# of downloads :

194

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Suspicious activity

Analysis date:

2026-09-27 19:21:55 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/79a4634f-0c63-44cf-ba63-d42d95c7d9f5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/89346/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader50.25737.62666681.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for synchronization primitives

Creating a window

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug fingerprint microsoft_visual_cc

Link:

https://www.filescan.io/uploads/6ab96a4fd737e0f378d30153/reports/58b3944b-0850-4e9c-8bad-a6ecaaa8abb2/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/b1f1fe9eaa28a32efb48a7a70a40ff7e5fcf7e633081ee65713833e5f695ebd5

Verdict:

Unknown

File Type:

exe x64

Link:

https://opentip.kaspersky.com/b1f1fe9eaa28a32efb48a7a70a40ff7e5fcf7e633081ee65713833e5f695ebd5/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/b43750b3-6929-4b91-95f4-f5b5ead10ea8

Score:

90%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/b1f1fe9eaa28a32efb48a7a70a40ff7e5fcf7e633081ee65713833e5f695ebd5

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/c04f0dc1cbefd3b345496edbd7cdfbc5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b1f1fe9eaa28a32efb48a7a70a40ff7e5fcf7e633081ee65713833e5f695ebd5/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=why75hvkfcrs562iu6tquqh7pzp467tdgca64zlrhaz6l5uv5pkq._file

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:salatstealer family:xmrig defense_evasion discovery execution miner persistence privilege_escalation spyware stealer trojan upx

Link:

https://tria.ge/reports/260927-xvz3rsvhqa/

Behaviour

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

Modifies registry class

Enumerates system info in registry

Checks processor information in registry

System Time Discovery

System Location Discovery: System Language Discovery

Reads the TCP/IP host and domain name from the registry

Executes a command shell one-liner

Browser Information Discovery

Drops file in Program Files directory

UPX packed file

Suspicious use of SetThreadContext

Enumerates connected drives

Contacts third-party web service commonly abused for C2

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Windows security modification

Executes dropped EXE

Executes a file named after a Windows system binary

Creates a file in the Startup directory

Downloads MZ/PE file

Badlisted process makes network request

XMRig Miner payload

Windows security bypass

UAC bypass

Family: xmrig

Family: salatstealer

Detect SalatStealer payload

Unpacked files

SH256 hash:

b1f1fe9eaa28a32efb48a7a70a40ff7e5fcf7e633081ee65713833e5f695ebd5

MD5 hash:

c04f0dc1cbefd3b345496edbd7cdfbc5

SHA1 hash:

b13cadbdd686db4a80445d6413708bdf2c5e6be4

Link:

https://www.unpac.me/results/c7f3c2a0-168d-43e1-be1e-fcc667e7d11f/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b1f1fe9eaa28/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b1f1fe9eaa28a32efb48a7a70a40ff7e5fcf7e633081ee65713833e5f695ebd5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

exe b1f1fe9eaa28a32efb48a7a70a40ff7e5fcf7e633081ee65713833e5f695ebd5

(this sample)

Dropped by

Gcleaner

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/89346/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample