xmrig | 2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_xmrig

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_xmrig
Size 5.2MB
Sample260708-jbfccsdv7j
SHA256 5298f87e9f47259bbf2e3b8d8d875a72bfeea85f3a0c46ce3bba970eb74f6421
MD5 75df2e820c38b6cc49801282d1cab620
SHA1 a807645fbdf9006349ead081e6f1bd68679ee972
SHA512 dab720ab85edb1c356d498495117f7a855e8478cfb48624987c1e9d9c1b58e56e9b5da1063d50f4bca3f16864db28f3b51f62240f2bf137d0cfa3cc83e68e2f4
SSDEEP 98304:7v5vFtZb+i/AAOWPsZCL2dAslrR7OkFaJBvHvY9gT9N2b8GToyodubix8EVy:7B7Z0aJBvvVN+80ru
TLSH
T1D346AE66E2B501E4C9BBC13CC94AC903E7F178194374EBDB12A446691F236D5AE3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
sample	xmrig
sample	family_xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_xmrig

File Explorer

2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_xmrig

.exe 5.2MB

2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_xmrig

IMPHASH 72b6ec48223e4d450dd235275dfa42a4
SHA256 5298f87e9f47259bbf2e3b8d8d875a72bfeea85f3a0c46ce3bba970eb74f6421
MD5 75df2e820c38b6cc49801282d1cab620
SHA1 a807645fbdf9006349ead081e6f1bd68679ee972
SHA512 dab720ab85edb1c356d498495117f7a855e8478cfb48624987c1e9d9c1b58e56e9b5da1063d50f4bca3f16864db28f3b51f62240f2bf137d0cfa3cc83e68e2f4
SSDEEP 98304:7v5vFtZb+i/AAOWPsZCL2dAslrR7OkFaJBvHvY9gT9N2b8GToyodubix8EVy:7B7Z0aJBvvVN+80ru
TLSH
T1D346AE66E2B501E4C9BBC13CC94AC903E7F178194374EBDB12A446691F236D5AE3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3265612

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

ntohs recv send WSASetLastError htons WSAIoctl WSAGetLastError select WSARecvFrom WSASocketW WSASend WSARecv gethostname WSADuplicateSocketW shutdown getpeername FreeAddrInfoW GetAddrInfoW htonl socket setsockopt listen closesocket bind WSACleanup WSAStartup getsockopt getsockname ioctlsocket

psapi

GetProcessMemoryInfo

iphlpapi

GetAdaptersAddresses

userenv

GetUserProfileDirectoryW

crypt32

CertGetCertificateContextProperty CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore

kernel32

GetStdHandle SetConsoleMode GetConsoleMode QueryPerformanceFrequency QueryPerformanceCounter SizeofResource LockResource LoadResource FindResourceW GetConsoleWindow GetSystemFirmwareTable HeapFree HeapAlloc GetProcessHeap MultiByteToWideChar SetPriorityClass GetCurrentProcess SetThreadPriority GetSystemPowerStatus GetCurrentThread GetProcAddress GetModuleHandleW GetTickCount CloseHandle FreeConsole VirtualProtect VirtualFree VirtualAlloc GetLargePageMinimum LocalAlloc GetLastError LocalFree FlushInstructionCache GetCurrentThreadId AddVectoredExceptionHandler DeviceIoControl GetModuleFileNameW CreateFileW SetLastError GetSystemTime SystemTimeToFileTime GetModuleHandleExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FindClose FindFirstFileW FindNextFileW WideCharToMultiByte GetFileType WriteFile ConvertFiberToThread ConvertThreadToFiber GetCurrentProcessId GetSystemTimeAsFileTime FreeLibrary LoadLibraryA LoadLibraryW GetEnvironmentVariableW ReadConsoleA ReadConsoleW PostQueuedCompletionStatus CreateFileA DuplicateHandle SetEvent ResetEvent WaitForSingleObject CreateEventA Sleep QueueUserWorkItem RegisterWaitForSingleObject UnregisterWait GetNumberOfConsoleInputEvents ReadConsoleInputW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW CreateDirectoryW FlushFileBuffers SetConsoleTitleA WriteConsoleW GetFileInformationByHandle GetFileSizeEx GetFinalPathNameByHandleW GetFullPathNameW ReadFile RemoveDirectoryW SetFilePointerEx SetFileTime GetSystemInfo MapViewOfFile FlushViewOfFile UnmapViewOfFile CreateFileMappingA ReOpenFile CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW InitializeCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS ReleaseSemaphore ResumeThread GetNativeSystemInfo CreateSemaphoreA SetConsoleCtrlHandler GetCurrentDirectoryW GetLongPathNameW GetShortPathNameW CreateIoCompletionPort ReadDirectoryChangesW VerSetConditionMask GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind SetCurrentDirectoryW GetTempPathW GlobalMemoryStatusEx VerifyVersionInfoA FileTimeToSystemTime SetHandleInformation CancelIo SetFileCompletionNotificationModes SetErrorMode GetQueuedCompletionStatus ConnectNamedPipe PeekNamedPipe CreateNamedPipeW CancelIoEx CancelSynchronousIo SwitchToThread TerminateProcess GetExitCodeProcess UnregisterWaitEx LCMapStringW DebugBreak FormatMessageA GetModuleHandleA GetStartupInfoW GetModuleFileNameA GetVersionExA GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask GetComputerNameA IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW InitializeSListHead GetFileAttributesW RtlUnwindEx RtlPcToFileHeader RaiseException LoadLibraryExW SetStdHandle GetCommandLineA GetCommandLineW CreateThread ExitThread FreeLibraryAndExitThread GetDriveTypeW SystemTimeToTzSpecificLocalTime ExitProcess GetFileAttributesExW SetFileAttributesW GetConsoleOutputCP FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetTimeZoneInformation HeapSize SetEndOfFile FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetDiskFreeSpaceW SetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread SleepConditionVariableSRW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo

user32

GetLastInputInfo ShowWindow GetProcessWindowStation GetUserObjectInformationW GetSystemMetrics MapVirtualKeyW DispatchMessageA TranslateMessage GetMessageA MessageBoxW

ole32

CoInitializeEx CoCreateInstance CoUninitialize

advapi32

SystemFunction036 GetUserNameW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW QueryServiceConfigA DeleteService ControlService StartServiceW OpenServiceW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken LsaOpenPolicy LsaAddAccountRights LsaClose GetTokenInformation

bcrypt

BCryptGenRandom

Name

.text

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

596KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_75df2e820c38b6cc49801282d1cab620_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar_xmrig

ws2_32

psapi

iphlpapi

userenv

crypt32

kernel32

user32

ole32

advapi32

bcrypt

generic