MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa2c2003123da6be943073eecd42749b847a6837ab34db769a39de567d5f64f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CoinMiner


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa2c2003123da6be943073eecd42749b847a6837ab34db769a39de567d5f64f9
SHA3-384 hash: 493346ad4eba738f3af5c5d65369c66bb0d1be49516b5918e9407ee04c9b23b965532ec6e49eb4ab158df107fff9884b
SHA1 hash: 95dcfae5d40a459014da27ea3015e41f1985cf7e
MD5 hash: d522da585866d893f42c5c30467f9646
humanhash: seven-happy-moon-mountain
File name:kworkerd-writeback
Download: download sample
Signature CoinMiner
Create hunting rule
File size:329'172 bytes
First seen:2026-06-25 13:48:48 UTC
Last seen:Never
File type: elf
MIME type:application/x-sharedlib
ssdeep 6144:1RQN8ILX9ADBy7G6vGSJD+hJ72YGRJqSx2LMJHIRSs5z/tqb1DZOf:3acy7GkHRuYG219Of
TLSH T197644B02FF445A43C5411FB15D7B07B6A3AD48916CA9E03D9D0BBF2506B38BAA5DF388
Magika elf
Reporter abuse_ch
Tags:CoinMiner elf upx-dec


Avatar
abuse_ch
UPX decompressed file, sourced from SHA256 d4da33ae42d743389d919ba21c3d75c3e3759e40633786504861fdf74dfbf5ab
File size (compressed) :110'608 bytes
File size (de-compressed) :329'172 bytes
Format:linux/ppc32
Packed file: d4da33ae42d743389d919ba21c3d75c3e3759e40633786504861fdf74dfbf5ab

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.BackDoor.Armada.1.30237.7191.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a file in the %temp% directory
Creating a file
Changes the time when the file was created, accessed, or modified
Changes access rights for a written file
Sets a written file as executable
Connection attempt
Launching a process
Manages services
Sends data to a server
Runs as daemon
Receives data from a server
Collects information on the CPU
Opens a port
Creates or modifies files in /cron to set up autorun
Substitutes an application name
Kills critical processes
Creates or modifies files in /init.d to set up autorun
Deleting of the original file
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
base64 gcc
Link:
https://www.filescan.io/uploads/6a3d31edcd75809716ff4201/reports/5e02fbb0-63f3-4de8-bf30-e95468248d3a/overview
Verdict:
Malicious
File Type:
elf.32.be
First seen:
2026-06-25T12:10:00Z UTC
Last seen:
2026-06-27T11:14:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/fa2c2003123da6be943073eecd42749b847a6837ab34db769a39de567d5f64f9/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/1252c182-d593-4a0a-8e21-3321220bea63
Behavior Graph:
Download SVG
%3 guuid=7468365e-1f00-0000-4315-748a68140000 pid=5224 /usr/bin/sudo guuid=86ecd460-1f00-0000-4315-748a69140000 pid=5225 /tmp/sample.bin guuid=7468365e-1f00-0000-4315-748a68140000 pid=5224->guuid=86ecd460-1f00-0000-4315-748a69140000 pid=5225 execve
Gathering data
Result
Threat name:
Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1933747
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops invisible ELF files
Executes itself again with its parent PID as an argument (indicative of hampering debugging)
Executes the "crontab" command typically for achieving persistence
Executes the "nc" (netcat) command used to establish arbitrary TCP or UDP connections and listens
Found strings related to Crypto-Mining
Opens /sys/class/net/* files useful for querying network interface information
Performs DNS TXT record lookups
Sample deletes itself
Sample tries to persist itself using cron
Searches for CPU information (likely indicative of DDoS capability)
Writes identical ELF files to multiple locations
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1933747 Sample: kworkerd-writeback.elf Startdate: 25/06/2026 Architecture: LINUX Score: 100 104 api.robotmarkethub.com 2->104 106 91.239.211.89, 34890, 34892, 34910 HOSTKEY-ASNL Germany 2->106 112 Antivirus detection for dropped file 2->112 114 Antivirus / Scanner detection for submitted sample 2->114 116 Yara detected Xmrig cryptocurrency miner 2->116 12 systemd sh 2->12         started        14 kworkerd-writeback.elf 2->14         started        17 systemd snapd-env-generator 2->17         started        19 systemd snapd-env-generator 2->19         started        signatures3 118 Performs DNS TXT record lookups 104->118 process4 signatures5 21 sh sh 12->21         started        24 sh wget 12->24         started        26 sh rm 12->26         started        138 Found strings related to Crypto-Mining 14->138 28 kworkerd-writeback.elf 14->28         started        process6 file7 92 /tmp/.exectest.5474, POSIX 21->92 dropped 94 /dev/shm/.exectest.5474, POSIX 21->94 dropped 30 sh .d 21->30         started        32 sh .d 21->32         started        34 sh wget 21->34         started        40 53 other processes 21->40 96 /tmp/..redis-sentinel, POSIX 24->96 dropped 38 kworkerd-writeback.elf 28->38         started        process8 file9 42 .d 30->42         started        44 .d 32->44         started        88 /dev/shm/.d, ELF 34->88 dropped 120 Writes identical ELF files to multiple locations 34->120 122 Drops invisible ELF files 34->122 46 kworkerd-writeback.elf sh 38->46         started        48 kworkerd-writeback.elf sh 38->48         started        90 /tmp/.d, ELF 40->90 dropped 124 Searches for CPU information (likely indicative of DDoS capability) 40->124 126 Sample deletes itself 40->126 128 Executes the "nc" (netcat) command used to establish arbitrary TCP or UDP connections and listens 40->128 50 sh nc 40->50         started        53 sh nc 40->53         started        55 sh grep 40->55         started        57 2 other processes 40->57 signatures10 process11 signatures12 59 .d 42->59         started        63 .d 44->63         started        65 sh systemctl 46->65         started        67 sh systemctl 48->67         started        108 Executes the "nc" (netcat) command used to establish arbitrary TCP or UDP connections and listens 50->108 110 Searches for CPU information (likely indicative of DDoS capability) 55->110 process13 file14 98 /var/spool/cron/crontabs/root, ASCII 59->98 dropped 132 Opens /sys/class/net/* files useful for querying network interface information 59->132 134 Sample deletes itself 59->134 136 Sample tries to persist itself using cron 59->136 69 .d sh 59->69         started        72 .d sh 59->72         started        74 .d sh 63->74         started        76 .d sh 63->76         started        signatures15 process16 signatures17 78 sh crontab 69->78         started        82 sh crontab 72->82         started        130 Executes itself again with its parent PID as an argument (indicative of hampering debugging) 74->130 84 sh crontab 74->84         started        86 sh crontab 76->86         started        process18 file19 100 /var/spool/cron/crontabs/tmp.ULC526, ASCII 78->100 dropped 102 /var/spool/cron/crontabs/tmp.zqD3wL, ASCII 84->102 dropped 140 Sample tries to persist itself using cron 84->140 142 Executes the "crontab" command typically for achieving persistence 84->142 signatures20
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/fa2c2003123da6be943073eecd42749b847a6837ab34db769a39de567d5f64f9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa2c2003123da6be943073eecd42749b847a6837ab34db769a39de567d5f64f9/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-06-25 13:49:46 UTC
File Type:
ELF32 Big (SO)
AV detection:
8 of 24 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7iwcaayshwtl5fbqopxm2qtutochu2bxvm2nw5u2hhpfm7k7mt4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fa2c2003123da6be943073eecd42749b847a6837ab34db769a39de567d5f64f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CoinMiner

elf d4da33ae42d743389d919ba21c3d75c3e3759e40633786504861fdf74dfbf5ab

CoinMiner

elf fa2c2003123da6be943073eecd42749b847a6837ab34db769a39de567d5f64f9

(this sample)

  
Dropped by
SHA256 d4da33ae42d743389d919ba21c3d75c3e3759e40633786504861fdf74dfbf5ab
  
URLhaus
https://urlhaus.abuse.ch/url/3868024/
  
Delivery method
Distributed via web download
  
Dropped by
MD5 8bdcdbd618ff1732e626360a2dcb3b3a

Comments