🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e482bb05fd3f02da69dc2df98077358c96bca532c77a53b87dd7b00732606cb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e482bb05fd3f02da69dc2df98077358c96bca532c77a53b87dd7b00732606cb0
SHA3-384 hash: ea81723098f84dec4643fac7c8c29d84e99c4340655df4b6e70f8dd2064dbb7dc10201de93ad14f89dd82841fa6c068a
SHA1 hash: ac65e049649eaa19b043e127a7461cb653e1471f
MD5 hash: 7c99676955af95b597fdb9114c9c5c83
humanhash: seven-dakota-venus-moon
File name:Chrome.exe
Download: download sample
Signature CoinMiner
Create hunting rule
File size:15'324'848 bytes
First seen:2026-09-25 21:32:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8e634bf18a2cb3c72ea1a67a6bf93841 (7 x CoinMiner)
ssdeep 393216:hAPafaBfss15v5HJ7icLeIb18kv8SP6zz3bo+y+zlPPo:aPaUfL1rccB1R8SgnawPA
TLSH T1C1F633FD7538E89EE6462CF9C9D60F699225B9A8840D7FBD13F00D990B45E346BCE009
TrID 45.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
18.0% (.EXE) Win64 Executable (generic) (6522/11/2)
13.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.6% (.ICL) Windows Icons Library (generic) (2059/9)
5.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon e862eae6b692c6ee (14 x CoinMiner, 3 x Azov, 1 x CoinMiner.XMRig)
Reporter aachum
Tags:CoinMiner dropped-by-ACRStealer exe signed

Code Signing Certificate

Organisation:Google LLC
Issuer:Google LLC
Algorithm:sha256WithRSAEncryption
Valid from:2026-09-24T21:06:17Z
Valid to:2046-09-25T21:06:17Z
Serial number: 5875f317feda827e782602168b60e092
Thumbprint Algorithm:SHA256
Thumbprint: 934b1a79d86770ff9c5e9f830c0fad0b3b0c5cc225a26098bfe1cda8a5e279ea
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
iamaachum
https://github.com/googchr/autoexe/releases/download/latest/Chrome.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-09-25 21:45:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a4abf8ab-dc6c-4b9c-b2c8-2f6f206bae46

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/89052/
Detection(s):
SecuriteInfo.com.Win64.Evo-gen.47539874.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Launching a service
Сreating synchronization primitives
Searching for synchronization primitives
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug installer-heuristic invalid-signature masquerade overlay packed packed self-signed-cert signed
Link:
https://www.filescan.io/uploads/6ab6e8655ea096a4d0d14aa8/reports/b1591db1-7833-43c2-ae03-1eff263b5ae3/overview
Verdict:
Malicious
Labled as:
Win64/TrojanDropper.Agent
Link:
https://www.hybrid-analysis.com/sample/e482bb05fd3f02da69dc2df98077358c96bca532c77a53b87dd7b00732606cb0
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-09-25T20:38:00Z UTC
Last seen:
2026-09-26T22:07:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/e482bb05fd3f02da69dc2df98077358c96bca532c77a53b87dd7b00732606cb0/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5acf0bd4-61f0-4f33-8430-5ce70a840d1d
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
bank.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1978386
Signature
AI detected suspicious PE / MSI digital signature
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to inject threads in other processes
Found direct / indirect Syscall (likely to bypass EDR)
Found stalling execution ending in API Sleep call
Found strings related to Crypto-Mining
Installs new ROOT certificates
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries DNS domain through GetComputerNameExW (potential sandbox evasion)
Registers a new ROOT certificate
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1978386 Sample: Chrome.exe Startdate: 25/09/2026 Architecture: WINDOWS Score: 100 86 prl.kryptex.network 2->86 88 eip-terr-na.cdp1.digicert.com.akahost.net 2->88 102 Multi AV Scanner detection for submitted file 2->102 104 Yara detected Xmrig cryptocurrency miner 2->104 106 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->106 108 2 other signatures 2->108 10 Chrome.exe 7 2->10         started        14 svchost.exe 2->14         started        16 googleupdater.exe 6 2->16         started        18 4 other processes 2->18 signatures3 process4 file5 82 C:\ProgramDatabehaviorgraphoogle\...\googleupdater.exe, PE32+ 10->82 dropped 84 C:\...\googleupdater.exe:Zone.Identifier, ASCII 10->84 dropped 122 Found stalling execution ending in API Sleep call 10->122 20 googleupdater.exe 12 11 10->20         started        124 Changes security center settings (notifications, updates, antivirus, firewall) 14->124 24 crashpad_handler.exe 16->24         started        26 chrome.exe 16->26         started        28 chrome.exe 16->28         started        30 7 other processes 16->30 signatures6 process7 file8 74 C:\ProgramDatabehaviorgraphoogle\...\nvidia-smi.exe, PE32+ 20->74 dropped 76 C:\ProgramDatabehaviorgraphoogle\Update\...\guanchor.dll, PE32+ 20->76 dropped 78 C:\ProgramData\...\crashpad_handler.exe, PE32+ 20->78 dropped 80 2 other files (1 malicious) 20->80 dropped 110 Multi AV Scanner detection for dropped file 20->110 112 Found stalling execution ending in API Sleep call 20->112 114 Registers a new ROOT certificate 20->114 32 googleupdater.exe 12 1 20->32         started        36 crashpad_handler.exe 1 20->36         started        38 chrome.exe 20->38         started        40 conhost.exe 24->40         started        signatures9 process10 file11 72 C:\Users\user\AppData\...\gucert_tmp.cer, Certificate, 32->72 dropped 92 Registers a new ROOT certificate 32->92 42 certutil.exe 5 1 32->42         started        45 conhost.exe 32->45         started        94 Contains functionality to inject threads in other processes 36->94 96 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 36->96 47 chrome.exe 36->47         started        50 conhost.exe 36->50         started        52 conhost.exe 36->52         started        98 Found strings related to Crypto-Mining 38->98 100 Found direct / indirect Syscall (likely to bypass EDR) 38->100 54 nvidia-smi.exe 38->54         started        56 nvidia-smi.exe 38->56         started        58 nvidia-smi.exe 38->58         started        60 3 other processes 38->60 signatures12 process13 dnsIp14 116 Installs new ROOT certificates 42->116 118 Queries DNS domain through GetComputerNameExW (potential sandbox evasion) 42->118 62 conhost.exe 42->62         started        90 prl.kryptex.network 23.88.2.85, 49713, 7048 HETZNER-ASDE Germany 47->90 120 Found direct / indirect Syscall (likely to bypass EDR) 47->120 64 nvidia-smi.exe 47->64         started        66 nvidia-smi.exe 47->66         started        68 nvidia-smi.exe 47->68         started        70 3 other processes 47->70 signatures15 process16
Score:
47%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/e482bb05fd3f02da69dc2df98077358c96bca532c77a53b87dd7b00732606cb0
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e482bb05fd3f02da69dc2df98077358c96bca532c77a53b87dd7b00732606cb0/
Threat name:
Win64.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-09-25 21:32:44 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4sblwbp5h4bnu2o4fx4ya5zvrsllzjjsy55fhod526yaomtansya._file
Unpacked files
SH256 hash:
e482bb05fd3f02da69dc2df98077358c96bca532c77a53b87dd7b00732606cb0
MD5 hash:
7c99676955af95b597fdb9114c9c5c83
SHA1 hash:
ac65e049649eaa19b043e127a7461cb653e1471f
Link:
https://www.unpac.me/results/05142163-3867-4884-9ea9-cce98a19bc8a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e482bb05fd3f02da69dc2df98077358c96bca532c77a53b87dd7b00732606cb0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

Executable exe e482bb05fd3f02da69dc2df98077358c96bca532c77a53b87dd7b00732606cb0

(this sample)

  
Link
https://tria.ge/260925-z6w7csxx6p/behavioral2
  
Dropped by
ACRStealer
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/89052/

Comments