xmrig | 2026-07-08_b50e243e3e552e5f7d988e8d03da48e5_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_b50e243e3e552e5f7d988e8d03da48e5_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 18.1MB
Sample260708-yttp2af17j
SHA256 f559732e2a91955eb9143324e56cd7c4f11f069bea96ade6c61a1d2159fdc0fa
MD5 b50e243e3e552e5f7d988e8d03da48e5
SHA1 380b33c9ad8f549820cfa3c638a802497bdaebbf
SHA512 522312f2d8b773daea6e1df7a9f2cbbfbc91e7361ff4ce024b24faf1589bbbc1d77429e65cf79b6228ee0b73ae699a31e09fc58410604e346363b9156103b8e0
SSDEEP 393216:8kFCUatKWEe6J+FeK/Ra+Hf7RJ+FevZ8Y27n1CVwa/:8T5isPzfB8t7noVP
TLSH
T19017E012B7A141E8C46EC538C246A633E7B1B8595370A7DF1AE4D7A62F23BD04E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
sample	xmrig
sample	family_xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_b50e243e3e552e5f7d988e8d03da48e5_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-08_b50e243e3e552e5f7d988e8d03da48e5_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 18.1MB

2026-07-08_b50e243e3e552e5f7d988e8d03da48e5_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH d2f6a6ed5f84e7c9b13eecf73397512d
SHA256 f559732e2a91955eb9143324e56cd7c4f11f069bea96ade6c61a1d2159fdc0fa
MD5 b50e243e3e552e5f7d988e8d03da48e5
SHA1 380b33c9ad8f549820cfa3c638a802497bdaebbf
SHA512 522312f2d8b773daea6e1df7a9f2cbbfbc91e7361ff4ce024b24faf1589bbbc1d77429e65cf79b6228ee0b73ae699a31e09fc58410604e346363b9156103b8e0
SSDEEP 393216:8kFCUatKWEe6J+FeK/Ra+Hf7RJ+FevZ8Y27n1CVwa/:8T5isPzfB8t7noVP
TLSH
T19017E012B7A141E8C46EC538C246A633E7B1B8595370A7DF1AE4D7A62F23BD04E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4861

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateProcessA CreateSemaphoreA DeleteCriticalSection DeleteFileA DuplicateHandle EnterCriticalSection FormatMessageA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetHandleInformation GetLastError GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount64 InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar OpenProcess OutputDebugStringA RaiseException ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _fstat64 _initterm _ismbblead _lseeki64 _onexit _setjmp _ultoa _vsnprintf _wfopen abort calloc exit fclose fflush fgetwc fopen fprintf fputc fputs free getc getenv iswctype localeconv longjmp malloc memchr memcmp memcpy memmove printf realloc setlocale setvbuf signal strchr strcmp strcoll strcpy strerror strftime strlen strncmp strtoul strxfrm towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm _vsnwprintf _write _strdup _read _fileno _fdopen

shell32

ShellExecuteA

Name

.text

Size

451KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

17.6MB

Virtual Size

17.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_b50e243e3e552e5f7d988e8d03da48e5_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

kernel32

msvcrt

shell32

generic