🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7c541e012ff4ded471bf15b45a20836bf6eb3693f2c656760912e4a2856e5aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7c541e012ff4ded471bf15b45a20836bf6eb3693f2c656760912e4a2856e5aa
SHA3-384 hash: 9283d5f4eed44a3f26faad9c6c6d16a012642618cf7670e8a966fb4c8710ff56267bc889769998eb0a074533b1a345af
SHA1 hash: e556f3b2c237863fe0cd1e74cd4fdf44fd47a574
MD5 hash: 95bbeff25b0f06be6d51a19f6e2bce55
humanhash: video-dakota-bravo-one
File name:handshakebins.sh
Download: download sample
Signature CoinMiner
Create hunting rule
File size:2'777 bytes
First seen:2026-09-29 06:36:19 UTC
Last seen:2026-09-30 05:56:31 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:wa5ba6l3Bn54ca+2QXFJiYJSGtAbdQBdfSQl9DmWxM+eEtX+Evi:Jb5JBn5pFkYI/udfP9Zq
TLSH T1B45136F9FD30CC31384D8C3A7E5D55949E970DAF0AE67C96708BAE24326D948B109738
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:CoinMiner sh

Intelligence

File Origin
# of uploads :
3
# of downloads :
65
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
busybox
Link:
https://www.filescan.io/uploads/6abb5c98196d783ec1a3b566/reports/a06fa516-c79f-42ed-b0fd-e03f02f726b8/overview
Verdict:
Unknown
File Type:
unix shell
First seen:
2026-09-29T03:46:00Z UTC
Last seen:
2026-09-30T14:54:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/c7c541e012ff4ded471bf15b45a20836bf6eb3693f2c656760912e4a2856e5aa/results?tab=lookup
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c7c541e012ff4ded471bf15b45a20836bf6eb3693f2c656760912e4a2856e5aa
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c7c541e012ff4ded471bf15b45a20836bf6eb3693f2c656760912e4a2856e5aa/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-29 06:37:32 UTC
File Type:
Text (Shell)
AV detection:
5 of 23 (21.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y7cudyas75g62ry36fnuliqig27w5m3jh4wgkz3asexeukcw4wva._file
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:gafgyt family:xmrig antivm botnet defense_evasion discovery execution linux miner persistence privilege_escalation
Link:
https://tria.ge/reports/260929-hdk5ystzbs/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads CPU attributes
Reads system network configuration
Modifies Bash startup script
Creates/modifies Cron job
Creates/modifies environment variables
Enumerates running processes
Modifies init.d
Modifies rc script
Modifies systemd
Reads system routing table
Schedules an At job
File and Directory Permissions Modification
Executes dropped EXE
Detected Gafgyt variant
Family: Gafgyt/Bashlite
Family: xmrig
XMRig Miner payload
Malware Config
C2 Extraction:
147.45.116.99:5548
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c7c541e012ff/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/c7c541e012ff4ded471bf15b45a20836bf6eb3693f2c656760912e4a2856e5aa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:LIN_Sample_Unique_586960df
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:586960df8bf559ffbba600f11917a99baed4a875cb7faa5eabc060bcde67277b.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

sh c7c541e012ff4ded471bf15b45a20836bf6eb3693f2c656760912e4a2856e5aa

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3924815/
  
Delivery method
Distributed via web download

Comments