🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d85508e7e10f702bd83e1baf01ff85820015666cd5da72add0802fbd30ccaff4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 18


Intelligence 18 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d85508e7e10f702bd83e1baf01ff85820015666cd5da72add0802fbd30ccaff4
SHA3-384 hash: b024e24ad8863ac03a21fc0b8467483c4d1387c4853bcde9e7c3e847731bb66ae726c828865926eab7acf4f5fa5ee211
SHA1 hash: 473f24d9aa1f01820e2e993da08430800cfdc45a
MD5 hash: f94244a9fb802f4523df36fa4fddeda2
humanhash: sweet-papa-south-ink
File name:file
Download: download sample
Signature CoinMiner
Create hunting rule
File size:2'155'419 bytes
First seen:2026-10-18 06:35:27 UTC
Last seen:2026-10-18 06:49:52 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 46ce5c12b293febbeb513b196aa7f843 (48 x GuLoader, 21 x RemcosRAT, 15 x AgentTesla)
ssdeep 49152:JUFrPLhKgTy6I5Yd7XCH4A+odx5HRkmBtvcBeA+:JwTYGy6bo1dxDHvOL+
TLSH T161A533A632A1B199CAA329311A35BE76159DB83528FD74676F117E1CB72F8C3E317002
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter Bitsight
Tags:b CoinMiner dropped-by-gcleaner exe MIX8.file


Avatar
Bitsight
url: http://91.92.242.236/service

Intelligence

File Origin
# of uploads :
2
# of downloads :
196
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/4cd8bdac-5693-4279-928a-9f1c527def92/
Malware family:
xmrig
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-18 07:33:02 UTC
Tags:
evasion miner xmrig
Link:
https://app.any.run/tasks/452884ed-796a-4b12-9b5b-f28e582e696c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CoinMiner02
Create hunting rule
Link:
https://www.capesandbox.com/analysis/92476/
Detection(s):
Win.Coinminer.Generic-7151250-0
Create hunting rule

Win.Coinminer.Generic-7151253-0
Create hunting rule

Win.Coinminer.Generic-7151447-0
Create hunting rule

Win.Coinminer.Generic-7151972-0
Create hunting rule

Win.Coinminer.Generic-7155777-0
Create hunting rule

Win.Coinminer.Generic-7158858-0
Create hunting rule

Win.Trojan.Coinminer-9866537-0
Create hunting rule

YARA.DITEKSHEN_MALWARE_Win_Coinminer02.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad46928f4e17c78f71644ad
Tags:
coinminer xmrig crypt miner
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file in the Program Files subdirectories
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Launching a process
Deleting a recently created file
Modifying a system file
Moving a system file
Replacing system files
Creating a file in the Windows subdirectories
Adding a root certificate
DNS request
Searching for synchronization primitives
Connecting to a cryptocurrency mining pool
Connection attempt
Creating a service
Launching a service
Loading a system driver
Creating a file in the system32 subdirectories
Possible injection to a system process
Enabling autorun for a service
Enabling autorun by creating a file
Gathering data
Verdict:
Malicious
Labled as:
TR/Dropper.Generic
Link:
https://www.hybrid-analysis.com/sample/d85508e7e10f702bd83e1baf01ff85820015666cd5da72add0802fbd30ccaff4
Verdict:
Adware
File Type:
exe x32
First seen:
2026-10-18T02:38:00Z UTC
Last seen:
2026-10-19T19:03:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/d85508e7e10f702bd83e1baf01ff85820015666cd5da72add0802fbd30ccaff4/results?tab=lookup
Malware family:
XMRig Miner
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/71436ec3-e9ef-4b1c-9e16-12e63babf887
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d85508e7e10f702bd83e1baf01ff85820015666cd5da72add0802fbd30ccaff4
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/f94244a9fb802f4523df36fa4fddeda2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d85508e7e10f702bd83e1baf01ff85820015666cd5da72add0802fbd30ccaff4/
Threat name:
Win32.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-10-18 06:36:20 UTC
File Type:
PE (Exe)
Extracted files:
15
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3bkqrz7bb5ycxwb6doxqd74fqiabkztm2xnhfloqqax32mgmv72a._file
Verdict:
malicious
Label(s):
xmrig
Create hunting rule
Link:
https://reports.threatray.com/0fce5245-4e53-492d-911f-177553553ecf
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig discovery execution miner
Link:
https://tria.ge/reports/261018-hc2fjshx3j/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Checks installed software on the system
Command and Scripting Interpreter: PowerShell
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Family: xmrig
XMRig Miner payload
Unpacked files
SH256 hash:
d85508e7e10f702bd83e1baf01ff85820015666cd5da72add0802fbd30ccaff4
MD5 hash:
f94244a9fb802f4523df36fa4fddeda2
SHA1 hash:
473f24d9aa1f01820e2e993da08430800cfdc45a
Link:
https://www.unpac.me/results/e77189c0-810e-4fbd-8215-8e91f3559a7e/
SH256 hash:
297e2643e6cc32026b481da3c169ccceb68f8df8a65b28dd74401c222879bd2e
MD5 hash:
585f4cd80ba340351751ae57a9ed74b8
SHA1 hash:
c5c7b1cf7c975704c5843fb7e76d1defaa9edbba
Link:
https://www.unpac.me/results/e77189c0-810e-4fbd-8215-8e91f3559a7e/
SH256 hash:
6fa80698d7268f6e88aa88c06fb27ee99e1bcee747c2e76911e6206a5b1aeeb3
MD5 hash:
d55877f44cd3a93f7f31a5437a615f6e
SHA1 hash:
687076e47a39abd783ba575f5356baefd18ab970
Detections:
XMRig
Create hunting rule
MALWARE_Win_CoinMiner02
Create hunting rule
MAL_XMR_Miner_May19_1
Create hunting rule
XMRIG_Monero_Miner
Create hunting rule
Link:
https://www.unpac.me/results/e77189c0-810e-4fbd-8215-8e91f3559a7e/
Parent samples :
916cf18c98363cf3419b4d51e9635dd1c610adb3b6d6264aac3f52a02b77541a
386aece5751535acf2c60a1cec037ec18da94d6a10237117debccbc0cf8ceaa7
ae00173d00f74bf65aa244ebf3885ae72c264162b6945af09c1eb7360ba45c44
6fa80698d7268f6e88aa88c06fb27ee99e1bcee747c2e76911e6206a5b1aeeb3
1fd4b7ca731ba501395eb9f93cfdea81a1d1b96c3b3850e654d34ac8a981c446
d85508e7e10f702bd83e1baf01ff85820015666cd5da72add0802fbd30ccaff4
82085eb1c4b7849873d2a186fda979823f1a69acded0e92391ea421be9f880ec
3bc0681c243e8d68365d246aea4ebb351dba1d7d753b134d98d48d8a0018e42d
49cae951cc10bc4c1fce008c7eb1c4850e1c65e55832b318ba9dbf9cd069da52
c4d1b790902c8d3ea0923498af35fc6b99c3633c7353bbb8429651a1cee0f854
66db6047fb9b392f07571278eef75b423f35eb94593a9b57f1ee1bbfb8b09db3
SH256 hash:
1dee37f6abb2dec9e767bd022d29386b6b295bbd55bf316d2649b8d298f89e9d
MD5 hash:
879b0aab93b11228a27d6b2e498b95be
SHA1 hash:
f5024d0d44c37443d7c17f1ff80fba301389ed42
Link:
https://www.unpac.me/results/e77189c0-810e-4fbd-8215-8e91f3559a7e/
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d85508e7e10f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d85508e7e10f702bd83e1baf01ff85820015666cd5da72add0802fbd30ccaff4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:NSIS
Create hunting rule
Author:kevoreilly
Description:NSIS Integrity Check function
Rule name:Win_Clipboard_Clipper_Thengavar
Create hunting rule
Author:Thengavar
Description:Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe d85508e7e10f702bd83e1baf01ff85820015666cd5da72add0802fbd30ccaff4

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/92476/

Comments