🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3c3827ca3d406d5f9e050593c052f5249e39add3cdfdaa1e9186e8bfe3bd68c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 7


Intelligence 7 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3c3827ca3d406d5f9e050593c052f5249e39add3cdfdaa1e9186e8bfe3bd68c
SHA3-384 hash: db24883e803ffb729aa1da718b6362135296745cf45f323ae812d913c300f21654085d053bee5f033c7de1488dbcaf82
SHA1 hash: a83c4d14050a6aee0c767bfd1017efb59cc1e62b
MD5 hash: 8aba3f331022fc04e11c9377c3a1ea2c
humanhash: lion-glucose-lake-minnesota
File name:e3c3827ca3d406d5f9e050593c052f5249e39add3cdfdaa1e9186e8bfe3bd68c
Download: download sample
Signature CoinMiner
Create hunting rule
File size:3'710'976 bytes
First seen:2026-10-30 17:17:08 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 98304:OYlxJGlcp86LJpXXcLwuns67WeLpYc+0yU+O:OYlxJGmp86ruwunp7LSc+8n
TLSH T1B60633B89F205E33328C204A4CA7959F5056F4D20B5DBC36216DB0EDE76DF88D79A278
Magika gzip
Reporter thinngo
Tags:CoinMiner dota3 gz honeypot Outlaw

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
GB GB
File Archive Information

This file archive contains 13 file(s), sorted by their relevance:

File name:run
File size:376 bytes
SHA256 hash: 289dfa1a65739556b5c90e844d558726b070350aefcad15b11bf83f969472c09
MD5 hash: e757884c25e6b616f2b636925ffc5026
MIME type:text/x-shellscript
Signature CoinMiner
File name:init
File size:967 bytes
SHA256 hash: 658040b1789b15e9ba238bae6520fc0cdcd7eebbdbda3774aef176790c6a2eab
MD5 hash: 7151baf2c01a76581e0f816c7f91de7e
MIME type:text/plain
Signature CoinMiner
File name:kthreadadd
File size:216 bytes
SHA256 hash: d6228ada864c88960c9b7f7d527f831ad7440daff4be455d895f4ad15d62223e
MD5 hash: 3a684fd75149823a983b121d7b4a22a2
MIME type:text/x-shellscript
Signature CoinMiner
File name:crond
File size:2'781'976 bytes
SHA256 hash: 2ab4da58efa51dadd0787a32b44cf8533d3d3a7bc1788123c112dcb267821030
MD5 hash: 531527ac24a1501cb39959c10a04a79b
MIME type:application/x-executable
Signature CoinMiner
File name:delsshd
File size:1'543 bytes
SHA256 hash: e450d3eb9d15c8585e776eabbec02fb6286e8738f9ef200746322da2f66fed93
MD5 hash: c26752eb21cd360070f2b757963a2fe2
MIME type:text/plain
Signature CoinMiner
File name:stop
File size:1'253 bytes
SHA256 hash: 767db73de8cbe6bf2ca192ef5730c70c1d3a9f1e4e783d5f3d8df2c52bc4fb5c
MD5 hash: df9471e0f14d5c6ee60768ae5cecb209
MIME type:text/x-shellscript
Signature CoinMiner
File name:init01
File size:9'389 bytes
SHA256 hash: 82eba36c8ac1613f451333eae4bff558e53cf814938d4b181790644371400eec
MD5 hash: e8ffc6aac5c2784b10319c25d229a44e
MIME type:text/x-shellscript
Signature CoinMiner
File name:init2
File size:713 bytes
SHA256 hash: 07e3060d67a7afb8a6ce14ca4e183bfa9436a28d2608b4e736a1278fd7a7d447
MD5 hash: f34e5bdf60d3c86facf84d899b6ae974
MIME type:text/plain
Signature CoinMiner
File name:a
File size:6'571 bytes
SHA256 hash: c8913c895f8ae2fc1ec6162850c0843f875f7882b6742550d68b101cbf662898
MD5 hash: 69c7923ed59fb2c2b98952e2388c152b
MIME type:text/x-shellscript
Signature CoinMiner
File name:kthreadadd32
File size:934'746 bytes
SHA256 hash: c7de6a1e621b27f64cea9573de262ff4d864b9f152661970854929969e265b42
MD5 hash: 417a8e9f761c05d639194185a881dd78
MIME type:application/x-executable
Signature CoinMiner
File name:rmkwork
File size:2'121 bytes
SHA256 hash: efa6d7375136e09ed7e0116f33d63ae34f480ebeaac82bdb1d11190714e6c793
MD5 hash: 93556f520cced7aaabbf4cf7dc066e57
MIME type:text/x-shellscript
Signature CoinMiner
File name:init02
File size:4'034 bytes
SHA256 hash: 6c1831216e42bd6f907e5f0f07a4c23e9e047dba3ca943fa7fe304d318c2555d
MD5 hash: 6929b19efca6d8371db14062d4535964
MIME type:text/x-shellscript
Signature CoinMiner
File name:clean.sh
File size:8'201 bytes
SHA256 hash: 486d24d4c640561478f4bdf813b208e04d483e11ba3f4306275f3655356e2762
MD5 hash: d49d1d183a20fb5a5faf51bad349f620
MIME type:text/x-shellscript
Signature CoinMiner
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Downloader-ADK.73226495.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.BV.Miner-ML.86921282.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.Tool.Linux.BtcMine.4877.24977.29603.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Python.Agent-BN.13321.10513.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Python.Agent-BN.17669.869.UNOFFICIAL
Create hunting rule

YARA.SIGNATURE_BASE_SUSP_LNX_Linux_Malware_Indicators_Aug20_1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac1cc91607b9f5856d740bd
Tags:
virus
Verdict:
Suspicious
Labled as:
Trojan.PY.Agent
Link:
https://www.hybrid-analysis.com/sample/e3c3827ca3d406d5f9e050593c052f5249e39add3cdfdaa1e9186e8bfe3bd68c
Verdict:
Malicious
File Type:
gz
First seen:
2026-10-30T16:01:00Z UTC
Last seen:
2026-10-31T22:18:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/e3c3827ca3d406d5f9e050593c052f5249e39add3cdfdaa1e9186e8bfe3bd68c/results?tab=lookup
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
GZip Archive
Link:
https://app.malva.re/file/8aba3f331022fc04e11c9377c3a1ea2c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e3c3827ca3d406d5f9e050593c052f5249e39add3cdfdaa1e9186e8bfe3bd68c/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-10-30 17:17:23 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4pbye7fd2qdnl6pakbmtybjpkje6hgw5htp5vipjdbxix7r322ga._file
Result
Malware family:
xmrig_linux
Create hunting rule
Score:
  10/10
Tags:
family:xmrig family:xmrig_linux antivm defense_evasion discovery linux miner persistence privilege_escalation rootkit upx
Link:
https://tria.ge/reports/261030-xg2z7sfw8p/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Reads CPU attributes
Checks hardware identifiers (DMI)
Enumerates running processes
Reads hardware information
Removes the immutable protection flag from a file
Write file to user bin folder
File and Directory Permissions Modification
Executes dropped EXE
Loads a kernel module
XMRig Miner payload
Family: xmrig
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e3c3827ca3d406d5f9e050593c052f5249e39add3cdfdaa1e9186e8bfe3bd68c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:Linux_Trojan_Kinsing_7cdbe9fa
Create hunting rule
Author:Elastic Security
Rule name:SUSP_LNX_Linux_Malware_Indicators_Aug20_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects indicators often found in linux malware samples. Note: This detection is based on common characteristics typically associated with the mentioned threats, must be considered a clue and does not conclusively prove maliciousness.
Reference:Internal Research
Rule name:SUSP_LNX_Linux_Malware_Indicators_Aug20_1_RID3621
Create hunting rule
Author:Florian Roth
Description:Detects indicators often found in linux malware samples
Reference:Internal Research
Rule name:SUSP_Websites
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference of suspicious sites that might be used to download further malware
Rule name:test_rule_vldslv
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments