xmrig | 2026-06-27_aa60ec1126db458cb43a61fcc8c9c52e_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xmrig

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_aa60ec1126db458cb43a61fcc8c9c52e_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xmrig
Size 6.7MB
Sample260629-eppezacx8y
SHA256 26a6a520aa6d15ce0a3caa8cd30513aac210acb2d82ce61a575baab15003f0c6
MD5 aa60ec1126db458cb43a61fcc8c9c52e
SHA1 63052bc90fb3c9f7190c028a325a13dd9bbf3c81
SHA512 9d9b564cb805fb93645c1383607871765fc4c71907178ec998c7e2c42228e871f77cecf3330b6ae27011b36ea6eeb92442c00f8cac28c85d003bed9efcc32874
SSDEEP 98304:QnOuk721zC6Ob2cUl/6pRedsp/KepIKJaz3eHp+ee6Mjr:ND7IzCt6cUIp+spiep70qHpNcjr
TLSH
T129667C17B6A500E8C57BC1388A969633E7B1B8195330ABDF16A4E7761F33AD05E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
sample	xmrig
sample	family_xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_aa60ec1126db458cb43a61fcc8c9c52e_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xmrig

File Explorer

2026-06-27_aa60ec1126db458cb43a61fcc8c9c52e_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xmrig

.exe 6.7MB

2026-06-27_aa60ec1126db458cb43a61fcc8c9c52e_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xmrig

IMPHASH e671371708bd81eace892dca501e3041
SHA256 26a6a520aa6d15ce0a3caa8cd30513aac210acb2d82ce61a575baab15003f0c6
MD5 aa60ec1126db458cb43a61fcc8c9c52e
SHA1 63052bc90fb3c9f7190c028a325a13dd9bbf3c81
SHA512 9d9b564cb805fb93645c1383607871765fc4c71907178ec998c7e2c42228e871f77cecf3330b6ae27011b36ea6eeb92442c00f8cac28c85d003bed9efcc32874
SSDEEP 98304:QnOuk721zC6Ob2cUl/6pRedsp/KepIKJaz3eHp+ee6Mjr:ND7IzCt6cUIp+spiep70qHpNcjr
TLSH
T129667C17B6A500E8C57BC1388A969633E7B1B8195330ABDF16A4E7761F33AD05E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Detects executables (downlaoders) containing URLs to raw contents of a paste
XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

CloseHandle CreateEventA CreateFileMappingW CreateFileW CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FindResourceW FlushInstructionCache FlushViewOfFile FormatMessageA GetCPInfo GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFileInformationByHandle GetFileSize GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTickCount64 InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetEvent SetLastError SetPriorityClass SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte Wow64GetThreadContext Wow64SetThreadContext WriteProcessMemory

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _exit _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _get_osfhandle _initterm _lock _lseeki64 _read _setjmp _setmode _strdup _strtoi64 _strtoui64 _time64 _unlock _vscprintf _vsnprintf _wfopen _write abort atexit calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset putc putwc rand realloc setlocale setvbuf srand strchr strcmp strcoll strerror strftime strlen strncmp strstr strtoul strxfrm tolower towupper ungetwc towlower ungetc vfprintf vswprintf_s wcschr wcscoll wcscpy_s wcsftime wcslen wcsstr wcstombs wcstombs_s wcsxfrm

ntdll

NtClose NtCreateSection NtMapViewOfSection NtOpenFile NtSetInformationFile NtWriteFile RtlInitUnicodeString

ole32

CoCreateInstance CoGetObject CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

shell32

CommandLineToArgvW

user32

GetDesktopWindow

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_aa60ec1126db458cb43a61fcc8c9c52e_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xmrig

advapi32

kernel32

msvcrt

ntdll

ole32

oleaut32

shell32

user32

winhttp

generic