s2
--:--:--UTC

Searching APEX

Starting…

  1. Searching Threats, IOCs & Threat Intelligence locally
  2. Querying external providers
  3. Asking AI Forensic Validator
  4. Creating new entry from validated hit

0s elapsed

MB-b9c43cbbc9b35df9f526e3863d782db4e8a9b89b7e693613bfa1e98c5c89cba2 high

📛 Threat Title

CoinMiner: file

Category: CoinMiner Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: exe. Size: 11776 bytes. Tags: CoinMiner, dropped-by-phorpiex, exe. Reporter: Bitsight. First seen: 2026-06-18 23:27:13.

Remediations (8)

  • web:blog.gridinsoft.com

    High CPU, fan noise, GPU spikes, or CoinMiner alert? Learn how to remove coin miner malware, find persistence, and avoid fake utility downloads in 2026.

  • web:github.com

    Cybercriminals are always looking for new ways to make money. With the rise of digital currencies, also known as cryptocurrencies, criminals see a unique opportunity to infiltrate an organization and secretly mine for coins by reconfiguring malware.

  • web:knowledge.broadcom.com

    For example, you may notice unexpected PowerShell processes connecting to IP addresses associated with xmrpool [.]net, nanopool [.]org, moneropool [.]com, and similar addresses. If Symantec Endpoint Protection (SEP) logs entries similar to those listed in Appendix B: Symantec signatures, this may indicate that a coinminer is active on the computer.

  • web:learn.microsoft.com

    Many infections start with: Email messages with attachments that try to install malware. Websites hosting exploit kits that attempt to use vulnerabilities in web browsers and other software to install coin miners. Websites taking advantage of computer processing power by running scripts while users browse the website. Mining is the process of running complex mathematical calculations necessary ...

  • web:www.huntress.com

    Coinminer removal instructions Manual removal of Coinminer should begin with isolating the affected system. Use trusted EDR solutions or Huntress remediation tools to scan and eliminate the malware. Check system processes for anomalies, disable persistent scheduled tasks, and look for unauthorized modifications in system registries.

  • web:www.malwarebytes.com

    Click Quarantine to remove the found threats. Business remediation How to remove CoinMiner .Trojan.Miner.DDS with the Malwarebytes Nebula console You can use the ThreatDown Anti-Malware Nebula console to scan endpoints. Choose the Scan + Quarantine option. Afterwards you can check the Detections page to see which threats were found.

  • web:www.malwarebytes.com

    Business remediation How to remove Trojan. CoinMiner with the Malwarebytes Nebula console You can use the Malwarebytes Anti-Malware Nebula console to scan endpoints. Nebula endpoint tasks menu Choose the Scan + Quarantine option. Afterwards you can check the Detections page to see which threats were found.

  • web:www.pcrisk.com

    COINMINER is a cryptominer - a type of malware that abuses system resources to generate revenue. The primary threats posed by such infections include decreased system performance or failure, data loss, hardware damage, and financial losses.

Indicators of Compromise (4)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_imphash 42cf01d41ef6dc0627982490afc9cddd

IOC database

Type
hash_imphash
Value
42cf01d41ef6dc0627982490afc9cddd
First seen
Last seen
Attached to this threat
Appears in
18 threats

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 b9c43cbbc9b35df9f526e3863d782db4e8a9b89b7e693613bfa1e98c5c89cba2

IOC database

Type
hash_sha256
Value
b9c43cbbc9b35df9f526e3863d782db4e8a9b89b7e693613bfa1e98c5c89cba2
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
CoinMiner

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha1 6a14d7057a17ff1af8e8c493275ca7d69362b266

IOC database

Type
hash_sha1
Value
6a14d7057a17ff1af8e8c493275ca7d69362b266
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_md5 9c49e1aa778a45e63e8fbff11108dae0

IOC database

Type
hash_md5
Value
9c49e1aa778a45e63e8fbff11108dae0
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: exe. Size: 11776 bytes. Tags: CoinMiner, dropped-by-phorpiex, exe. Reporter: Bitsight. First seen: 2026-06-18 23:27:13.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.