MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3fc2840cec07dff9c35f528bbe7b3efbe1d60d9a8de9d1467a47cfa7016c278. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 10

Intelligence 10 IOCs YARA 5 File information Comments

SHA256 hash:	e3fc2840cec07dff9c35f528bbe7b3efbe1d60d9a8de9d1467a47cfa7016c278
SHA3-384 hash:	578cca37f99d3681b48718f0e081496bd4806af8060f474ffa1b30267f2ee94d74949253da830e895d93f59fd45a4d40
SHA1 hash:	466582a1fb4067184d922c8bb99b6b80446d9acf
MD5 hash:	32ec145d7a9d191831e30f782ae2b950
humanhash:	xray-lactose-uncle-network
File name:	e3fc2840cec07dff9c35f528bbe7b3efbe1d60d9a8de9d1467a47cfa7016c278.exe
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	5'248'512 bytes
First seen:	2026-09-03 20:07:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	949ec789a5933fb6051c9013a550fb57 (38 x CoinMiner)
ssdeep	98304:O0RmZOA3EC7F0Tb5m9E9E2QMEgejq1GbycH5F37tFHWUc+zid3r:OSmZOA3EWCWE9vkgKF3LHWUc+ud
TLSH	T11A3633AE6CC611B0D586C778162324BEB13EBBE6C591BD07BBDC29058D93D09A07D3D2
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	whack_sh
Tags:	CoinMiner exe whack.sh

Intelligence

File Origin

# of uploads :

# of downloads :

164

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/af5cc999-7832-4c67-9d53-8a22a29a4b93/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/83821/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Launching a process

Creating a process with a hidden window

Creating a service

Launching a service

Creating a process from a recently created file

Creating a file in the Windows subdirectories

Deleting a recently created file

Creating a file in the system32 subdirectories

Moving of the original file

Enabling autorun for a service

Unauthorized injection to a system process

Adding an exclusion to Microsoft Defender

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6a99d3b3df83447f6e841f0f/reports/abd59bf0-3853-4749-a633-cf12302f5151/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/e3fc2840cec07dff9c35f528bbe7b3efbe1d60d9a8de9d1467a47cfa7016c278

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d628878e-1139-4393-b12c-37971da54fc0

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e3fc2840cec07dff9c35f528bbe7b3efbe1d60d9a8de9d1467a47cfa7016c278

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/32ec145d7a9d191831e30f782ae2b950

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e3fc2840cec07dff9c35f528bbe7b3efbe1d60d9a8de9d1467a47cfa7016c278/

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2026-09-04 01:14:38 UTC

File Type:

PE+ (Exe)

AV detection:

17 of 36 (47.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4p6cqqgoyb677hbv6uulxz5t567b2ygzvdpj2fdhur6pu4awyj4a._file

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig defense_evasion execution miner persistence

Link:

https://tria.ge/reports/260903-ywn8bseq81/

Behaviour

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Launches sc.exe

Drops file in System32 directory

Suspicious use of SetThreadContext

Power Settings

Creates new service(s)

Cryptocurrency Miner

Deletes itself

Disables service(s)

Executes dropped EXE

Stops running service(s)

Command and Scripting Interpreter: PowerShell

Server Software Component: Terminal Services DLL

Sets service image path in registry

XMRig Miner payload

Family: xmrig

Modifies security service

Suspicious use of NtCreateUserProcessOtherParentProcess

Unpacked files

SH256 hash:

e3fc2840cec07dff9c35f528bbe7b3efbe1d60d9a8de9d1467a47cfa7016c278

MD5 hash:

32ec145d7a9d191831e30f782ae2b950

SHA1 hash:

466582a1fb4067184d922c8bb99b6b80446d9acf

Link:

https://www.unpac.me/results/cdb37ba3-5b1b-4724-a3c8-e4c986ecd3cf/

Malware family:

XMRig

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e3fc2840cec0/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)