xmrig | 2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

General

Target
2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig
Size 12.6MB
Sample260630-empyqaex5m
SHA256 8e0dca4dff21d30c00d36f33c3920ef1312dee4149f86a65a77e48c8c15bda20
MD5 bfbc9501eeb114e281b9e1f626fb2d23
SHA1 78c0a3edf2ef5dbd9d7eaed8d8dad823dba99609
SHA512 8a02fb8140932b328728252d6f3c0c6750b7fa7a4e7f60170aab48cea5afe349455f497f448e9dc030cd1fe1d3f1f2db79951f476cbabad7ab436692f8cd9024
SSDEEP 196608:ARC/NM0rDoxrix2PkZvdAv5n1gpgiXRC/NM0rDoxrix2PkZvdAv5n1gpgi:Ahex2PkZvdm51PiXhex2PkZvdm51Pi
TLSH
T12DD69D26B7A401E8C87AC53CCA469607E7F2B81A5370A7DB17B0567A1F336D45E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
sample	xmrig
sample	family_xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

File Explorer

2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

.exe 12.6MB

2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

IMPHASH 2284a13a4a8ca6ee220487c6db891e57
SHA256 8e0dca4dff21d30c00d36f33c3920ef1312dee4149f86a65a77e48c8c15bda20
MD5 bfbc9501eeb114e281b9e1f626fb2d23
SHA1 78c0a3edf2ef5dbd9d7eaed8d8dad823dba99609
SHA512 8a02fb8140932b328728252d6f3c0c6750b7fa7a4e7f60170aab48cea5afe349455f497f448e9dc030cd1fe1d3f1f2db79951f476cbabad7ab436692f8cd9024
SSDEEP 196608:ARC/NM0rDoxrix2PkZvdAv5n1gpgiXRC/NM0rDoxrix2PkZvdAv5n1gpgi:Ahex2PkZvdm51PiXhex2PkZvdm51Pi
TLSH
T12DD69D26B7A401E8C87AC53CCA469607E7F2B81A5370A7DB17B0567A1F336D45E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

10500

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

wsprintfA wvsprintfA

shell32

SHGetFolderPathA

advapi32

RegSetValueExA RegOpenKeyExA RegCloseKey

kernel32

CreateFileW WriteConsoleW ExitProcess CreateDirectoryA CreateFileA WriteFile CloseHandle GetLastError CreateProcessA GetLocalTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW SetFilePointerEx RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle GetModuleFileNameW GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12.5MB

Virtual Size

12.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

user32

shell32

advapi32

kernel32

generic