YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash ad00e3d82dc43fcc9c352617ff45d97eba78fb47cdf3b6af067e972711099c0b.

Scan Results

SHA256 hash:	ad00e3d82dc43fcc9c352617ff45d97eba78fb47cdf3b6af067e972711099c0b
File size:	5'108'736 bytes
File download:	Original
MIME type:	application/x-dosexec
MD5 hash:	0e8f799e8ececf0f9c06a7be93b88439
SHA1 hash:	13239a79f4c86ef6a8a3ed1135f159203f735b2a
SHA3-384 hash:	7fe43945f3fc0822a7b5a8068f79c6764603718f390337ce906a7356e2b3a309d184292b02e4432113030e5d8c14cfb0
First seen:	2026-03-29 17:31:14 UTC
Last seen:	Never
Sightings:	1
imphash :	14ec8f3f7eee2e31d6dc574514386b4d Create hunting rule
ssdeep :	98304:t5AfKZ70gcjrWgcTKUAEiLityOebCX+eHi7V6ENsdC:sMmUAEqitCeXTiRXsdC
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	165e4e10-2b95-11f1-b47f-42010aa4000b
File name:	0e8f799e8ececf0f9c06a7be93b88439
Task parameters:	ClamAV scan:	True
	Unpack:	False
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	Win.Coinminer.Generic-7151253-0 Create hunting rule

Signature:	Win.Coinminer.Generic-7151447-0 Create hunting rule

Signature:	Win.Coinminer.Generic-7155777-0 Create hunting rule

Signature:	Win.Trojan.Coinminer-9866537-0 Create hunting rule

Signature:	YARA.DITEKSHEN_MALWARE_Win_Coinminer02.UNOFFICIAL Create hunting rule

Signature:	YARA.SIGNATURE_BASE_PUA_Crypto_Mining_Commandline_Indicators_Oct21.UNOFFICIAL Create hunting rule

Signature:	YARA.SIGNATURE_BASE_PUA_WIN_XMRIG_Cryptocoin_Miner_Dec20.UNOFFICIAL Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants
TLP:	TLP:WHITE
Repository:

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	MacOS_Cryptominer_Xmrig_241780a1 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MAL_XMR_Miner_May19_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Monero Crypto Coin Miner
Reference:	https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
TLP:	TLP:WHITE

Rule name:	MAL_XMR_Miner_May19_1_RID2E1B Create hunting rule
Author:	Florian Roth
Description:	Detects Monero Crypto Coin Miner
Reference:	https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
TLP:	TLP:WHITE

Rule name:	MALWARE_Win_CoinMiner02 Create hunting rule
Author:	ditekSHen
Description:	Detects coinmining malware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants
TLP:	TLP:WHITE
Repository:

Rule name:	Multi_Cryptominer_Xmrig_f9516741 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	pe_detect_tls_callbacks Create hunting rule
Author:
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	PUA_Crypto_Mining_CommandLine_Indicators_Oct21 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects command line parameters often used by crypto mining software
Reference:	https://www.poolwatch.io/coin/monero
TLP:	TLP:WHITE

Rule name:	PUA_WIN_XMRIG_CryptoCoin_Miner_Dec20 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects XMRIG crypto coin miners
Reference:	https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	PUA_WIN_XMRIG_CryptoCoin_Miner_Dec20_RID33BA Create hunting rule
Author:	Florian Roth
Description:	Detects XMRIG crypto coin miners
Reference:	https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/
TLP:	TLP:WHITE

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	rig_win64_xmrig_6_13_1_xmrig Create hunting rule
Author:	yarGen Rule Generator
Description:	rig_win64 - file xmrig.exe
Reference:	https://github.com/Neo23x0/yarGen
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants
TLP:	TLP:WHITE
Repository:

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants
TLP:	TLP:WHITE
Repository:

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants
TLP:	TLP:WHITE
Repository:

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	WHIRLPOOL_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for WhirlPool constants
TLP:	TLP:WHITE
Repository:

Rule name:	Windows_Cryptominer_Generic_f53cfb9b Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	XMRIG_Monero_Miner Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Monero mining software
Reference:	https://github.com/xmrig/xmrig/releases
TLP:	TLP:WHITE

Rule name:	xmrig_v1 Create hunting rule
Author:	RandomMalware
TLP:	TLP:WHITE
Repository:	YARAify

Unpacker

The following YARA rules matched on the unpacked file.

Disabled by submitter

Unpacked Files

The following files could be unpacked from this sample.