MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 df1725526b23e3ddb09667fe5d9a519d704f536e5a7b701029f58b00097dcab2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
CoinMiner
Vendor detections: 15
| SHA256 hash: | df1725526b23e3ddb09667fe5d9a519d704f536e5a7b701029f58b00097dcab2 |
|---|---|
| SHA3-384 hash: | e768d0a5fff41373f1fd02db2ec851f001902c6be9f440d708d7639acb8615a849831c6c3671fe5113a9590f6b6b1e20 |
| SHA1 hash: | 78313c13b49a9f52bd56c3e6f44f758a6cdba4c0 |
| MD5 hash: | 46788513abe0249be6e91828315aeb09 |
| humanhash: | sixteen-purple-fifteen-hawaii |
| File name: | Valorant Hile.exe |
| Download: | download sample |
| Signature | CoinMiner |
| File size: | 2'236'928 bytes |
| First seen: | 2026-01-22 17:48:15 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 02549ff92b49cce693542fc9afb10102 (88 x CoinMiner, 2 x CoinMiner.XMRig, 1 x AgentTesla) |
| ssdeep | 49152:LlVWGvUBg+fG5rQgTrWNcHPMY8xqgB8gc8YzUmZUr9Cn8t7vJro:LiQL+faHW2PMlBBKr1ZEC8pvW |
| Threatray | 431 similar samples on MalwareBazaar |
| TLSH | T16CA533BABDFDC2B8DA9B30B81184661FC16A42681EA0D33383DFB43E5515EE4569F025 |
| TrID | 55.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 16.9% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.9% (.ICL) Windows Icons Library (generic) (2059/9) 6.8% (.EXE) OS/2 Executable (generic) (2029/13) 6.7% (.EXE) Generic Win/DOS Executable (2002/3) |
| Magika | pebin |
| Reporter |  burger |
| Tags: | CoinMiner donutloader exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
98
Origin country :
NLVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
ValorantHile.exe
Verdict:
No threats detected
Analysis date:
2026-01-22 17:48:10 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CoinMiner02
Verdict:
Malicious
Score:
99.1%
Tags:
autorun shell virus sage
Verdict:
Malicious
Labled as:
Trojan.Generic
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-01-22T14:51:00Z UTC
Last seen:
2026-01-24T02:21:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Inject.sb HEUR:Trojan.Win64.DonutInjector.gen HEUR:Trojan.Win32.Generic Trojan.Win64.Inject.sb Trojan.Win64.DonutInjector.sb Trojan.Win64.Donut.sb Trojan.Win32.Shellcode.sb PDM:Trojan.Win32.Generic RiskTool.BitCoinMiner.UDP.C&C RiskTool.BitCoinMiner.TCP.C&C
Malware family:
Donut Injector
Verdict:
Malicious
Result
Threat name:
SilentXMRMiner, Xmrig
Detection:
malicious
Classification:
evad.mine
Score:
100 / 100
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates a thread in another existing process (thread injection)
Detected Stratum mining protocol
Drops executables to the windows directory (C:\Windows) and starts them
Found direct / indirect Syscall (likely to bypass EDR)
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Potential Crypto Mining Activity
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Xmrig
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected SilentXMRMiner
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Verdict:
Malicious
Threat:
Family.XMRIG
Threat name:
Win64.Trojan.Donut
Status:
Malicious
First seen:
2026-01-22 17:48:11 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
24 of 32 (75.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
donutloader
Similar samples:
+ 421 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Score:
10/10
Tags:
family:xmrig execution miner persistence
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Drops file in System32 directory
Suspicious use of SetThreadContext
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
XMRig Miner payload
Xmrig family
xmrig
Unpacked files
SH256 hash:
df1725526b23e3ddb09667fe5d9a519d704f536e5a7b701029f58b00097dcab2
MD5 hash:
46788513abe0249be6e91828315aeb09
SHA1 hash:
78313c13b49a9f52bd56c3e6f44f758a6cdba4c0
Malware family:
XMRig
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
CoinMiner
Score:
0.60
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.