MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7b1cf77eccf7fab42d83f57facdb1105d51050295a044ecdf75cc8280679788. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7b1cf77eccf7fab42d83f57facdb1105d51050295a044ecdf75cc8280679788
SHA3-384 hash: 64a919f607f480717775437a51c7e28b703d095b2cc97087ac8d4568c8b8607c2f60d8bed89a49db4c22e38a054a412a
SHA1 hash: 7900cfedd44cd639839f0c4f6d382e62fd541046
MD5 hash: ba1a663e230ce317ae337b5d83046ee7
humanhash: floor-indigo-music-burger
File name:mKM65Cf6QNqeOVw9.exe
Download: download sample
File size:5'283'328 bytes
First seen:2026-08-04 13:11:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 35171f6f6a1bfee47cbc04cb345c411f (25 x CoinMiner)
ssdeep 98304:6eEZUQ9DLUUK09ofcc9uFsX4luxO/39bAOnnYBsvUQeOyj:5AXRTMuqIu2FvUQe
TLSH T1D1363380BCC299B5D4A6C3FC595374BDF33ABBB28564BC1576ED28044DAEE24253E780
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
151
Origin country :
SE SE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/77bd50bf-6348-4991-b99f-d0a1710d9fb3/
Malware family:
phorpiex
Create hunting rule
ID:
1
File name:
hgf.zip
Verdict:
Malicious activity
Analysis date:
2026-08-04 12:25:15 UTC
Tags:
phorpiex botnet solaris loader powershell generic python screenconnect remote github obfuscated-vbs phishing xmrig miner ipfs massbass maskgram stealer telegram nemucod glamour rat arcticagent autoit clickfix possible-phishing stealc datto rmm-tool advancedinstaller vidar salatstealer evasion pastebin cryptowall ransomware action1 clipper diamotrix rustdesk ip-check putty ftp phantom remus wannacry pyinstaller
Link:
https://app.any.run/tasks/92d382f0-519d-4f8f-b3ca-ccdbf31b539b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/78784/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Launching a process
Creating a process with a hidden window
Creating a service
Launching a service
Creating a process from a recently created file
Creating a file in the Windows subdirectories
Deleting a recently created file
Creating a file in the system32 subdirectories
Searching for synchronization primitives
Enabling autorun for a service
Moving of the original file
Disabling the operating system update service
Unauthorized injection to a system process
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6a71e5456e4125887070fd53/reports/8f032531-fa31-4f44-b993-0bee1e8e5500/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b7b1cf77eccf7fab42d83f57facdb1105d51050295a044ecdf75cc8280679788
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/86dbe027-1433-440e-91a2-cc86926a241b
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1951993
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates / moves files in alternative data streams (ADS)
Deletes itself after installation
Found direct / indirect Syscall (likely to bypass EDR)
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Modifies windows update settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Protects its processes via BreakOnTermination flag
Sample is not signed and drops a device driver
Sigma detected: Disable Important Scheduled Task
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Unusual module load detection (module proxying)
Uses cmd line tools excessively to alter registry or file data
Uses nslookup.exe to query domains
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1951993 Sample: mKM65Cf6QNqeOVw9.exe Startdate: 04/08/2026 Architecture: WINDOWS Score: 100 61 polygon-bor-rpc.publicnode.com 2->61 73 Suricata IDS alerts for network traffic 2->73 75 Malicious sample detected (through community Yara rule) 2->75 77 Antivirus / Scanner detection for submitted sample 2->77 79 7 other signatures 2->79 9 LockAppHost14a02b.exe 2->9         started        12 mKM65Cf6QNqeOVw9.exe 8 2->12         started        signatures3 process4 file5 81 Antivirus detection for dropped file 9->81 83 Multi AV Scanner detection for dropped file 9->83 85 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 9->85 93 5 other signatures 9->93 15 nslookup.exe 4 13 9->15         started        57 C:\ProgramData\...\LockAppHost14a02b.exe, PE32+ 12->57 dropped 59 C:\...\LockAppHost14a02b.exe:Zone.Identifier, ASCII 12->59 dropped 87 Creates / moves files in alternative data streams (ADS) 12->87 89 Deletes itself after installation 12->89 91 Found direct / indirect Syscall (likely to bypass EDR) 12->91 20 sc.exe 1 12->20         started        22 sc.exe 1 12->22         started        24 sc.exe 1 12->24         started        signatures6 process7 dnsIp8 63 polygon-bor-rpc.publicnode.com 104.20.24.117, 443, 49781 CLOUDFLARENET-CloudflareIncUS Canada 15->63 55 C:\Windows\Temp\oeoajqda.sys, PE32+ 15->55 dropped 65 Suspicious powershell command line found 15->65 67 Protects its processes via BreakOnTermination flag 15->67 69 Uses cmd line tools excessively to alter registry or file data 15->69 71 8 other signatures 15->71 26 powershell.exe 23 15->26         started        29 powershell.exe 23 15->29         started        31 reg.exe 17 1 15->31         started        39 29 other processes 15->39 33 conhost.exe 20->33         started        35 conhost.exe 22->35         started        37 conhost.exe 24->37         started        file9 signatures10 process11 signatures12 95 Loading BitLocker PowerShell Module 26->95 41 conhost.exe 26->41         started        43 conhost.exe 29->43         started        45 conhost.exe 31->45         started        47 conhost.exe 39->47         started        49 conhost.exe 39->49         started        51 conhost.exe 39->51         started        53 26 other processes 39->53 process13
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b7b1cf77eccf7fab42d83f57facdb1105d51050295a044ecdf75cc8280679788
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/ba1a663e230ce317ae337b5d83046ee7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b7b1cf77eccf7fab42d83f57facdb1105d51050295a044ecdf75cc8280679788/
Threat name:
Win64.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-04 13:12:42 UTC
File Type:
PE+ (Exe)
AV detection:
15 of 36 (41.67%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w6y4657mz572wqwyh5l7vtnrcbovcbicswqej3g7oxgifadhs6ea._file
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig defense_evasion execution miner persistence
Link:
https://tria.ge/reports/260804-qfbnasfm2s/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Power Settings
Creates new service(s)
Cryptocurrency Miner
Deletes itself
Disables service(s)
Executes dropped EXE
Stops running service(s)
Command and Scripting Interpreter: PowerShell
Server Software Component: Terminal Services DLL
Sets service image path in registry
XMRig Miner payload
Family: xmrig
Modifies security service
Suspicious use of NtCreateUserProcessOtherParentProcess
Unpacked files
SH256 hash:
b7b1cf77eccf7fab42d83f57facdb1105d51050295a044ecdf75cc8280679788
MD5 hash:
ba1a663e230ce317ae337b5d83046ee7
SHA1 hash:
7900cfedd44cd639839f0c4f6d382e62fd541046
Link:
https://www.unpac.me/results/ef5aa75f-c5f3-4642-b71e-21c99958b1b6/
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b7b1cf77eccf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe b7b1cf77eccf7fab42d83f57facdb1105d51050295a044ecdf75cc8280679788

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3894884/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/78784/

Comments