🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 11


Intelligence 11 IOCs YARA 61 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338
SHA3-384 hash: 225f16d2f040e2066bb03d1d8c25c211b9d174720288427382ebd95e95c7b0fabff31d4574d83df97ae6a03660dc557c
SHA1 hash: 3f25a9e96f627c0757eb243453510f86414e0c61
MD5 hash: c35654598bdde344f7e7f469568ab3e1
humanhash: cola-hydrogen-mike-illinois
File name:ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:45'986'145 bytes
First seen:2026-10-30 00:08:45 UTC
Last seen:2026-10-30 00:33:58 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 1465e7eab8316965aaa8e0b0ce1d221d (15 x CoinMiner, 10 x SalatStealer)
ssdeep 786432:zgHEsg/Y2enhCVf0ah0KTUku84Oqqn34f1ABapHHqdWdjRvGCx+cmgE0T:FAgVcah06UfN+349A8HH7rGk+c2S
TLSH T189A733C5B4BF84ADEA24B1366443B851B2AFCF056F962F974882307437A229451CFE5F
TrID 51.9% (.EXE) Win64 Executable (generic) (6522/11/2)
16.1% (.EXE) OS/2 Executable (generic) (2029/13)
15.9% (.EXE) Generic Win/DOS Executable (2002/3)
15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon 2996969696969696 (6 x CoinMiner, 2 x SalatStealer)
Reporter Tuxxin
Tags:CoinMiner exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
162
Origin country :
FR FR
Vendor Threat Intelligence
Malware configuration found for:
SplitBlock
Details
Link:
https://research.acce.ciphertechsolutions.com/results/e148831f-efac-4aa7-9da6-117ce4fb0632/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae3e045b121dd519dcea801
Tags:
autorun emotet
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug expand lolbin mingw overlay packed
Link:
https://www.filescan.io/uploads/6ae3e0387a8fa2ba204fcbdf/reports/305b4e5f-5cad-4a0b-8a53-6d047517de22/overview
Verdict:
Malicious
Labled as:
Agent.Generic
Link:
https://www.hybrid-analysis.com/sample/ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-10-26T19:24:00Z UTC
Last seen:
2026-10-29T22:54:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338/results?tab=lookup
Result
Threat name:
SRBMiner, Salat Stealer, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1994959
Signature
Adds extensions / path to Windows Defender exclusion list (Registry)
Allocates memory in foreign processes
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Connects to a pastebin service (likely for C&C)
Contains functionality to inject threads in other processes
Creates files in the system32 config directory
Creates multiple autostart registry keys
Detected unpacking (changes PE section rights)
Drops executable to a common third party application directory
Found direct / indirect Syscall (likely to bypass EDR)
Found strings related to Crypto-Mining
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Potential Privilege Escalation using Task Scheduler highest RunLevel
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample is not signed and drops a device driver
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges
Sigma detected: Suspicious Schtasks Execution AppData Folder
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sleep reduction / modifications
Unusual module load detection (module proxying)
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Salat Stealer
Yara detected SRBMiner
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1994959 Sample: 1AdMiyn6JO.exe Startdate: 30/10/2026 Architecture: WINDOWS Score: 100 111 pastebin.com 2->111 113 sa1atik.cn 2->113 115 5 other IPs or domains 2->115 127 Malicious sample detected (through community Yara rule) 2->127 129 Multi AV Scanner detection for dropped file 2->129 131 Multi AV Scanner detection for submitted file 2->131 135 9 other signatures 2->135 10 1AdMiyn6JO.exe 6 18 2->10         started        14 MicrosoftCacheAssistant.exe 2->14         started        16 MicrosoftCacheAssistant.exe 2->16         started        18 10 other processes 2->18 signatures3 133 Connects to a pastebin service (likely for C&C) 111->133 process4 file5 103 C:\Users\user\AppData\...\1AdMiyn6JO.exe, PE32+ 10->103 dropped 173 Adds extensions / path to Windows Defender exclusion list (Registry) 10->173 20 1AdMiyn6JO.exe 3 10->20         started        175 Contains functionality to inject threads in other processes 14->175 177 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 14->177 179 Tries to detect sleep reduction / modifications 14->179 24 WerFault.exe 16->24         started        181 Creates files in the system32 config directory 18->181 183 Changes security center settings (notifications, updates, antivirus, firewall) 18->183 27 WerFault.exe 18->27         started        29 WerFault.exe 18->29         started        31 WerFault.exe 18->31         started        signatures6 process7 dnsIp8 93 C:\Users\user\...\SearchProtocolHost.exe, PE32+ 20->93 dropped 95 C:\Users\user\...\SearchFilterHost.exe, PE32+ 20->95 dropped 153 Multi AV Scanner detection for dropped file 20->153 33 SearchProtocolHost.exe 55 21 20->33         started        38 SearchFilterHost.exe 341 19 20->38         started        117 150.171.109.150, 443, 49740, 49742 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 24->117 file9 signatures10 process11 dnsIp12 105 193.233.198.26, 8088 DHOST-ASRU Germany 33->105 107 127.0.0.1 unknown unknown 33->107 77 C:\Users\user\AppData\...\taskmgr_hook.dll, PE32+ 33->77 dropped 79 C:\Users\user\AppData\Local\...\sm5C67.tmp, PE32+ 33->79 dropped 81 C:\Users\user\AppData\Local\...\g3.exe, PE32 33->81 dropped 89 5 other malicious files 33->89 dropped 137 Found strings related to Crypto-Mining 33->137 139 Creates multiple autostart registry keys 33->139 141 Contains functionality to inject threads in other processes 33->141 149 7 other signatures 33->149 40 g3.exe 2 4 33->40         started        45 MicrosoftUpdateWorker.exe 33->45         started        47 MicrosoftUpdateHealth.exe 33->47         started        55 8 other processes 33->55 109 pastebin.com 104.20.29.150, 443, 49715, 49716 CLOUDFLARENET-CloudflareIncUS Canada 38->109 83 C:\Users\user\AppData\...\taskmgr_hook.dll, PE32+ 38->83 dropped 85 C:\Users\user\AppData\...\WinRing0x64.sys, PE32+ 38->85 dropped 87 C:\Users\user\...\MicrosoftCacheWorker.exe, PE32+ 38->87 dropped 91 5 other malicious files 38->91 dropped 143 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 38->143 145 Uses schtasks.exe or at.exe to add and modify task schedules 38->145 147 Uses netsh to modify the Windows network and firewall settings 38->147 151 4 other signatures 38->151 49 MicrosoftCacheWorker.exe 38->49         started        51 MicrosoftCacheHealth.exe 38->51         started        53 schtasks.exe 1 38->53         started        57 4 other processes 38->57 file13 signatures14 process15 dnsIp16 119 dns.google 8.8.8.8, 443, 49724, 49756 GOOGLE-GoogleLLCUS United States 40->119 121 cloudflare-dns.com 104.16.248.249, 443, 49722, 49755 CLOUDFLARENET-CloudflareIncUS Canada 40->121 123 sa1atik.cn 46.173.27.15, 443, 49729, 49758 BEGET-ASRU Russia 40->123 97 C:\Users\user\...\Cy0QngjiUFLuC78A0AB1sQ.exe, PE32 40->97 dropped 99 C:\Program Files (x86)\...\qQWq8BgK7kfcP.exe, PE32 40->99 dropped 155 Multi AV Scanner detection for dropped file 40->155 157 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 40->157 159 Creates multiple autostart registry keys 40->159 161 Drops executable to a common third party application directory 40->161 163 Antivirus detection for dropped file 45->163 59 WerFault.exe 45->59         started        165 Detected unpacking (changes PE section rights) 49->165 167 Hides threads from debuggers 49->167 169 Unusual module load detection (module proxying) 49->169 171 Found direct / indirect Syscall (likely to bypass EDR) 49->171 61 conhost.exe 49->61         started        63 conhost.exe 53->63         started        125 208.167.233.7, 443, 49717 AS-VULTR-TheConstantCompanyLLCUS United States 55->125 101 C:\Users\user\AppData\Local\...\cpu_xmr.log, ASCII 55->101 dropped 65 conhost.exe 55->65         started        67 conhost.exe 55->67         started        73 5 other processes 55->73 69 conhost.exe 57->69         started        71 conhost.exe 57->71         started        75 2 other processes 57->75 file17 signatures18 process19
Score:
28%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338
Gathering data
Threat name:
Win64.Trojan.AdvML
Create hunting rule
Status:
Malicious
First seen:
2026-10-27 00:20:53 UTC
File Type:
PE+ (Exe)
Extracted files:
7
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zya3fiiiciopeoefii7krs45l7dnlxvsefbloiot5uj546csqm4a._file
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:salatstealer family:xmrig defense_evasion discovery execution miner persistence privilege_escalation stealer trojan upx
Link:
https://tria.ge/reports/261030-afpbdsvs2l/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Event Triggered Execution: Netsh Helper DLL
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
UPX packed file
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Executes dropped EXE
Windows security modification
Modifies Windows Firewall
Detect SalatStealer payload
Family: salatstealer
Family: xmrig
Windows security bypass
XMRig Miner payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:Detect_Go_GOMAXPROCS
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Golang_Find_CSC846
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:Golang_Find_CSC846_Simple
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:Heuristics_ChromeABE
Create hunting rule
Author:Still
Description:attempts to match instructions related to Chrome App-bound Encryption elevation service; possibly spotted amongst infostealers
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Author:ditekSHen
Description:Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:Macos_Infostealer_Wallets_8e469ea0
Create hunting rule
Author:Elastic Security
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:Multi_Generic_Threat_19854dc2
Create hunting rule
Author:Elastic Security
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:Rooter
Create hunting rule
Author:Seth Hardy
Description:Rooter
Rule name:RooterStrings
Create hunting rule
Author:Seth Hardy
Description:Rooter Identifying Strings
Rule name:Salat
Create hunting rule
Author:kevoreilly
Description:Salat Payload
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Suspicious_Golang_Binary
Create hunting rule
Author:Tim Machac
Description:Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:UPX
Create hunting rule
Author:kevoreilly
Description:UPX Unpacker: dump on OEP (original entry point)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
Rule name:VIGIA_SalatStealer_e7f7c88c
Create hunting rule
Author:VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:SalatStealer detection using an observed build artifact or paired host-process indicators with build corroboration
Reference:https://vigia.bisite.es/
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Trojan_SalatStealer_03d2a4ee
Create hunting rule
Author:Elastic Security
Rule name:Win_Clipboard_Clipper_Thengavar
Create hunting rule
Author:Thengavar
Description:Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks
Rule name:WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Fantom (pe, etat extrait)
Rule name:WIN_Malware_PythonStealer_ForgeAuto_b24cb5bd
Create hunting rule
Author:Marjoriefort
Description:Detects PythonStealer (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_1762e598_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2e3a5916_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2ffc3572
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_30f84f37
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_37b4704b
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_3ee43008
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe ce01b2a108121cf23885423ea8cb9d5fc6d5deb22142b721d3ed13de78528338

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/4034461/

Comments