MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8176877cc9f083324e0d69c2d932a98129eb4ad3f6f24ecf7d002cbaafcc8b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CoinMiner

Vendor detections: 5

Intelligence 5 IOCs YARA 12 File information Comments

SHA256 hash:	f8176877cc9f083324e0d69c2d932a98129eb4ad3f6f24ecf7d002cbaafcc8b8
SHA3-384 hash:	e95b638c205b942df58b28e78f0780f2df3f840c884f63c6066c49367f4933bcb7c37827de78a7b09961e2bda8e174e0
SHA1 hash:	a6a97b0783cb60d7f3e0d095d05578bdd8b32c03
MD5 hash:	e845e076010e2d82b21834496b1ee5c6
humanhash:	neptune-mango-august-six
File name:	45b7ab01bd1003a9b7ce99ed56c811bfc86e302ad643229495ca6e08ebd84433.zip
Download:	download sample
Signature	CoinMiner Create hunting rule
File size:	3'150'112 bytes
First seen:	2026-10-07 08:40:29 UTC
Last seen:	2026-10-20 08:51:52 UTC
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: infected
ssdeep	49152:hESTciGOzxUfUwSe1yiMAKV1QR3wR4Bos9q6r/pbDzJ6FvsXefhcUycCQJLnOS6t:hGOzmfU/iBQKmLs9qM/deRfhChQpOlt
TLSH	T1D1E533E7A3DA578F61E2382170DB25012951E504AE730F6E579EEADEA4CC21FD076323
TrID	66.6% (.WIDGET) Konfabulator widget (8000/1/2) 33.3% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	DarkDataLabs
Tags:	CoinMiner

Intelligence

File Origin

# of uploads :

# of downloads :

115

Origin country :

File Archive Information

This file is a password protected archive. The password is: infected

This file archive contains 14 file(s), sorted by their relevance:

File name:	run
File size:	376 bytes
SHA256 hash:	289dfa1a65739556b5c90e844d558726b070350aefcad15b11bf83f969472c09
MD5 hash:	e757884c25e6b616f2b636925ffc5026
MIME type:	text/x-shellscript
Signature	CoinMiner

File name:	init
File size:	967 bytes
SHA256 hash:	658040b1789b15e9ba238bae6520fc0cdcd7eebbdbda3774aef176790c6a2eab
MD5 hash:	7151baf2c01a76581e0f816c7f91de7e
MIME type:	text/plain
Signature	CoinMiner

File name:	kthreadadd
File size:	216 bytes
SHA256 hash:	d6228ada864c88960c9b7f7d527f831ad7440daff4be455d895f4ad15d62223e
MD5 hash:	3a684fd75149823a983b121d7b4a22a2
MIME type:	text/x-shellscript
Signature	CoinMiner

File name:	crond
File size:	2'213'128 bytes
SHA256 hash:	a01e58ce02a7b7fe9e5368878d30ce576d958069b30e952ff68686e2264b3292
MD5 hash:	01a3ca860b8d0dc45c339d121a8dd44a
MIME type:	application/x-executable
Signature	CoinMiner

File name:	delsshd
File size:	1'543 bytes
SHA256 hash:	e450d3eb9d15c8585e776eabbec02fb6286e8738f9ef200746322da2f66fed93
MD5 hash:	c26752eb21cd360070f2b757963a2fe2
MIME type:	text/plain
Signature	CoinMiner

File name:	stop
File size:	1'253 bytes
SHA256 hash:	767db73de8cbe6bf2ca192ef5730c70c1d3a9f1e4e783d5f3d8df2c52bc4fb5c
MD5 hash:	df9471e0f14d5c6ee60768ae5cecb209
MIME type:	text/x-shellscript
Signature	CoinMiner

File name:	v
File size:	0 bytes
SHA256 hash:	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
MD5 hash:	d41d8cd98f00b204e9800998ecf8427e
MIME type:	inode/x-empty
Signature	CoinMiner

File name:	init01
File size:	9'389 bytes
SHA256 hash:	82eba36c8ac1613f451333eae4bff558e53cf814938d4b181790644371400eec
MD5 hash:	e8ffc6aac5c2784b10319c25d229a44e
MIME type:	text/x-shellscript
Signature	CoinMiner

File name:	init2
File size:	713 bytes
SHA256 hash:	07e3060d67a7afb8a6ce14ca4e183bfa9436a28d2608b4e736a1278fd7a7d447
MD5 hash:	f34e5bdf60d3c86facf84d899b6ae974
MIME type:	text/plain
Signature	CoinMiner

File name:	a
File size:	6'571 bytes
SHA256 hash:	c8913c895f8ae2fc1ec6162850c0843f875f7882b6742550d68b101cbf662898
MD5 hash:	69c7923ed59fb2c2b98952e2388c152b
MIME type:	text/x-shellscript
Signature	CoinMiner

File name:	kthreadadd32
File size:	934'952 bytes
SHA256 hash:	fd1c0aad77a102600ae0a06d495647f55b5285d2ca811f9a92f6dda56e5a956b
MD5 hash:	f7b4522e86005c668bd4ac1edbbf786e
MIME type:	application/x-executable
Signature	CoinMiner

File name:	rmkwork
File size:	2'121 bytes
SHA256 hash:	efa6d7375136e09ed7e0116f33d63ae34f480ebeaac82bdb1d11190714e6c793
MD5 hash:	93556f520cced7aaabbf4cf7dc066e57
MIME type:	text/x-shellscript
Signature	CoinMiner

File name:	init02
File size:	4'034 bytes
SHA256 hash:	6c1831216e42bd6f907e5f0f07a4c23e9e047dba3ca943fa7fe304d318c2555d
MD5 hash:	6929b19efca6d8371db14062d4535964
MIME type:	text/x-shellscript
Signature	CoinMiner

File name:	clean.sh
File size:	8'201 bytes
SHA256 hash:	486d24d4c640561478f4bdf813b208e04d483e11ba3f4306275f3655356e2762
MD5 hash:	d49d1d183a20fb5a5faf51bad349f620
MIME type:	text/x-shellscript
Signature	CoinMiner

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/04fa6d5d-aacb-4351-a299-fd9e5c1a6ec0/

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad02e836f551121ba15a552

Tags:

n/a

Result

Verdict:

Unknown

File Type:

ZIP File

Link:

https://app.docguard.net/f8176877cc9f083324e0d69c2d932a98129eb4ad3f6f24ecf7d002cbaafcc8b8/results/dashboard

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f8176877cc9f083324e0d69c2d932a98129eb4ad3f6f24ecf7d002cbaafcc8b8

Verdict:

Unknown

File Type:

zip

Link:

https://opentip.kaspersky.com/f8176877cc9f083324e0d69c2d932a98129eb4ad3f6f24ecf7d002cbaafcc8b8/results?tab=lookup

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Zip Archive

Link:

https://app.malva.re/file/e845e076010e2d82b21834496b1ee5c6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f8176877cc9f083324e0d69c2d932a98129eb4ad3f6f24ecf7d002cbaafcc8b8/

Threat name:

Win32.Trojan.Ravartar

Status:

Malicious

First seen:

2026-10-07 08:41:20 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

1 of 24 (4.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7alwq56mt4edgjha22oc3ezktajj5nfnh5xsj3hx2abmxkx4zc4a._file

Result

Malware family:

xmrig_linux

Score:

10/10

Tags:

family:xmrig_linux antivm defense_evasion discovery linux miner persistence privilege_escalation rootkit upx

Link:

https://tria.ge/reports/261007-lkjggsw13n/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Reads CPU attributes

Checks hardware identifiers (DMI)

Enumerates running processes

Reads hardware information

Removes the immutable protection flag from a file

Write file to user bin folder

File and Directory Permissions Modification

Executes dropped EXE

Loads a kernel module

XMRig Miner payload

Family: xmrig

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Trojan_Kinsing_7cdbe9fa Create hunting rule
Author:	Elastic Security

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	SUSP_LNX_Linux_Malware_Indicators_Aug20_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects indicators often found in linux malware samples. Note: This detection is based on common characteristics typically associated with the mentioned threats, must be considered a clue and does not conclusively prove maliciousness.
Reference:	Internal Research

Rule name:	SUSP_LNX_Linux_Malware_Indicators_Aug20_1_RID3621 Create hunting rule
Author:	Florian Roth
Description:	Detects indicators often found in linux malware samples
Reference:	Internal Research

Rule name:	SUSP_Websites Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the reference of suspicious sites that might be used to download further malware

Rule name:	test_rule_vldslv Create hunting rule

Rule name:	TH_Generic_MassHunt_Linux_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Linux malware mass-hunt rule - 2026
Reference:	https://cyfare.net/

Rule name:	upx_packed_elf_v1 Create hunting rule
Author:	RandomMalware

Rule name:	WHIRLPOOL_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample