xmrig | 2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig
Size 10.4MB
Sample260708-wpb83sd18p
SHA256 690e59b4a4db4fb7ee2a54f06918a57c28b13b0e8652c0a41515fdeb58487727
MD5 47bcbb4f47de6a30ffe927712cb99100
SHA1 50958ab542806038d06d731539ad02193763d71e
SHA512 b45850ced24e42497bf1a18abf344af48f44d45faf7fa6a909e9cb58f3e3d2d6eee879774a3df50a44a4bf4e8761ee00d2dfe55fe036f23fe0a0d02f01f6f130
SSDEEP 196608:KV/II/6aYXdFD22VatktKpEEd1Qiw1J+46eK/PZAWNsy3RNMx2+x1J+46eke7HS:6kFCUatKWEe6J+FeK/Ra+NMxBjJ+FePy
TLSH
T177B6CF16B7A401E8C86AC538C64A9633E7B1B8195374A7CF26F4D2691F33BD05E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
sample	xmrig
sample	family_xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

File Explorer

2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

.exe 10.4MB

2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

IMPHASH fe09193dd00dca364da173d5b0d26539
SHA256 690e59b4a4db4fb7ee2a54f06918a57c28b13b0e8652c0a41515fdeb58487727
MD5 47bcbb4f47de6a30ffe927712cb99100
SHA1 50958ab542806038d06d731539ad02193763d71e
SHA512 b45850ced24e42497bf1a18abf344af48f44d45faf7fa6a909e9cb58f3e3d2d6eee879774a3df50a44a4bf4e8761ee00d2dfe55fe036f23fe0a0d02f01f6f130
SSDEEP 196608:KV/II/6aYXdFD22VatktKpEEd1Qiw1J+46eK/PZAWNsy3RNMx2+x1J+46eke7HS:6kFCUatKWEe6J+FeK/Ra+NMxBjJ+FePy
TLSH
T177B6CF16B7A401E8C86AC538C64A9633E7B1B8195374A7CF26F4D2691F33BD05E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4861

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA RegCloseKey RegOpenKeyExA RegSetValueExA

kernel32

AddVectoredExceptionHandler CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateMutexA CreateProcessA CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection FindResourceA FormatMessageA GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetFileAttributesA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GlobalMemoryStatusEx InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW RaiseException ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryA SetEvent SetFileAttributesA SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _fstat64 _initterm _ismbblead _lseeki64 _onexit _setjmp _ultoa _vsnprintf _wcsicmp _wfopen abort calloc exit fclose fflush fgetwc fopen fprintf fputc fputs free getc getenv isalnum iswctype localeconv longjmp malloc memchr memcmp memcpy memmove printf rand realloc setlocale setvbuf signal srand strchr strcmp strcoll strcpy strerror strftime strlen strncmp strtol strtoul strxfrm tan tolower toupper towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm _vsnwprintf _write _strdup _read _fileno _fdopen

shell32

ShellExecuteA

wininet

HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetOpenUrlA InternetReadFile

Name

.text

Size

515KB

Virtual Size

514KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8.7MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_47bcbb4f47de6a30ffe927712cb99100_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

advapi32

kernel32

msvcrt

shell32

wininet

generic