🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da074ef5707b4d685734dea298bf5ced3bcc0dbf38f7242f7e50ab4585b61d55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da074ef5707b4d685734dea298bf5ced3bcc0dbf38f7242f7e50ab4585b61d55
SHA3-384 hash: 6540f52473279c70a9f3402b85e64e48f9f92217d5b5104ceb4f916b4201259e18de800a4f8727c475961bf3aac3cf0d
SHA1 hash: 886a790c5845f349e719fa1ac7b38d5be7dc1a76
MD5 hash: 15e582e08ab23708f6bd790335ef050f
humanhash: fix-michigan-maine-robin
File name:656b90c4553ec077f0ff60bf35edee765dffa4d63d4e2148221f9ef1171bb437.zip
Download: download sample
Signature CoinMiner
Create hunting rule
File size:5'137'722 bytes
First seen:2026-09-06 20:04:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
Note:This file is a password protected archive. The password is: infected
ssdeep 98304:JZIC3yxsnjMyxQLyP/oWEX9QtyEZQl271ysdl1Z6boYghC1ZdFj2:JZZixQjMyeyP/ZA9QLZQk7pdmoZhC1o
TLSH T18C36338BF14F25AB0F8F4D412994899728B1626DF396F8AFB6C00F874B54D19342B4F6
Magika zip
Reporter rifteyy
Tags:CoinMiner Uacbypass vulnerable-driver XMRIG zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
CZ CZ
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:656b90c4553ec077f0ff60bf35edee765dffa4d63d4e2148221f9ef1171bb437.exe
File size:5'271'552 bytes
SHA256 hash: 656b90c4553ec077f0ff60bf35edee765dffa4d63d4e2148221f9ef1171bb437
MD5 hash: c7d899d6f7ccecb85c409767d8645906
MIME type:application/x-dosexec
Signature CoinMiner
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/d3543933-f82d-4c44-b000-d723332595c4/
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/da074ef5707b4d685734dea298bf5ced3bcc0dbf38f7242f7e50ab4585b61d55/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6a9dc78248cf513eb5e9213e/reports/5cfc9ecc-8195-4072-be0e-6ae6864870b5/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/da074ef5707b4d685734dea298bf5ced3bcc0dbf38f7242f7e50ab4585b61d55
Verdict:
Unknown
File Type:
zip
Link:
https://opentip.kaspersky.com/da074ef5707b4d685734dea298bf5ced3bcc0dbf38f7242f7e50ab4585b61d55/results?tab=lookup
Score:
99%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/da074ef5707b4d685734dea298bf5ced3bcc0dbf38f7242f7e50ab4585b61d55
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Zip Archive
Link:
https://app.malva.re/file/15e582e08ab23708f6bd790335ef050f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da074ef5707b4d685734dea298bf5ced3bcc0dbf38f7242f7e50ab4585b61d55/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3idu55lqpngwqvzu32rjrp245u54ydn7hd3sil36kcvulbnwdvkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.30
Link:
https://yomi.yoroi.company/submissions/da074ef5707b4d685734dea298bf5ced3bcc0dbf38f7242f7e50ab4585b61d55

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

anyrun
any.run
https://app.any.run/tasks/18807eb8-74fa-489d-bfb7-4786f993ac58

Comments