xmrig | 2026-07-11_c676c56a57c29299fcdbf6f00142f374_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_xmrig

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_c676c56a57c29299fcdbf6f00142f374_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_xmrig
Size 5.3MB
Sample260711-pmx97sav7p
SHA256 453de0c99895eefdcf8c86c4c9dd1c34713b92f05aa0c4db4167a20fdeef57e6
MD5 c676c56a57c29299fcdbf6f00142f374
SHA1 a8b4324759bde003c0d171fb9abc63152396a7ef
SHA512 cd2a4c1681ad4c6ab688a02b44fb38e5934300a60fdf5cbdcb95ec9000c911a326846d78f0f22e924b63c46f10d7ae1ad6aa926f61d8aac5eda4384368b48dea
SSDEEP 98304:LNtZ3t3q6cUIBzmMTzIf3ZdrtpTV/Wlhsav3Ip/ik2IYHoMYk:p3t5TV+lhNI9i7fnYk
TLSH
T140469D56B2A500E8C8BBC47CC6479617F7F2B81943B0ABDB27B056691F236D15E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	family_xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_c676c56a57c29299fcdbf6f00142f374_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_xmrig

File Explorer

2026-07-11_c676c56a57c29299fcdbf6f00142f374_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_xmrig

.exe 5.3MB

2026-07-11_c676c56a57c29299fcdbf6f00142f374_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_vidar_xmrig

IMPHASH 14c1585cec9f2f1bd8a61c93c95651de
SHA256 453de0c99895eefdcf8c86c4c9dd1c34713b92f05aa0c4db4167a20fdeef57e6
MD5 c676c56a57c29299fcdbf6f00142f374
SHA1 a8b4324759bde003c0d171fb9abc63152396a7ef
SHA512 cd2a4c1681ad4c6ab688a02b44fb38e5934300a60fdf5cbdcb95ec9000c911a326846d78f0f22e924b63c46f10d7ae1ad6aa926f61d8aac5eda4384368b48dea
SSDEEP 98304:LNtZ3t3q6cUIBzmMTzIf3ZdrtpTV/Wlhsav3Ip/ik2IYHoMYk:p3t5TV+lhNI9i7fnYk
TLSH
T140469D56B2A500E8C8BBC47CC6479617F7F2B81943B0ABDB27B056691F236D15E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3534308

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

recv ntohs htons send WSASetLastError WSAGetLastError select WSARecvFrom WSASocketW WSASend WSARecv WSAIoctl gethostname WSADuplicateSocketW shutdown getpeername FreeAddrInfoW GetAddrInfoW htonl socket setsockopt listen closesocket bind WSACleanup WSAStartup getsockopt getsockname ioctlsocket

iphlpapi

GetAdaptersAddresses

userenv

GetUserProfileDirectoryW

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertGetCertificateContextProperty CertDuplicateCertificateContext CertFreeCertificateContext CertFindCertificateInStore

kernel32

SetConsoleMode GetConsoleMode QueryPerformanceFrequency QueryPerformanceCounter SizeofResource LockResource LoadResource FindResourceW ExpandEnvironmentStringsA GetConsoleWindow GetSystemFirmwareTable HeapFree HeapAlloc GetProcessHeap MultiByteToWideChar SetPriorityClass GetCurrentProcess SetThreadPriority GetSystemPowerStatus GetCurrentThread GetProcAddress GetModuleHandleW GetTickCount CloseHandle FreeConsole VirtualProtect VirtualFree VirtualAlloc GetLargePageMinimum LocalAlloc GetLastError LocalFree FlushInstructionCache GetCurrentThreadId AddVectoredExceptionHandler DeviceIoControl GetModuleFileNameW CreateFileW SetLastError GetSystemTime SystemTimeToFileTime GetModuleHandleExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FindClose FindFirstFileW FindNextFileW WideCharToMultiByte GetFileType WriteFile ConvertFiberToThread ConvertThreadToFiber GetCurrentProcessId GetSystemTimeAsFileTime FreeLibrary LoadLibraryA LoadLibraryW GetEnvironmentVariableW ReadConsoleA ReadConsoleW PostQueuedCompletionStatus CreateFileA DuplicateHandle SetEvent ResetEvent WaitForSingleObject CreateEventA Sleep QueueUserWorkItem RegisterWaitForSingleObject UnregisterWait GetNumberOfConsoleInputEvents ReadConsoleInputW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW CreateDirectoryW FlushFileBuffers GetDiskFreeSpaceW GetFileAttributesW SetUnhandledExceptionFilter GetFileSizeEx SetConsoleTitleA GetFullPathNameW ReadFile RemoveDirectoryW SetFilePointerEx SetFileTime GetSystemInfo MapViewOfFile FlushViewOfFile UnmapViewOfFile CreateFileMappingA ReOpenFile CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW InitializeCriticalSection SetConsoleCtrlHandler GetCurrentDirectoryW GetLongPathNameW GetShortPathNameW CreateIoCompletionPort ReadDirectoryChangesW VerSetConditionMask GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetCurrentDirectoryW GetTempPathW GlobalMemoryStatusEx VerifyVersionInfoA FileTimeToSystemTime RtlUnwind K32GetProcessMemoryInfo SetHandleInformation CancelIo SwitchToThread SetFileCompletionNotificationModes LoadLibraryExW FormatMessageA SetErrorMode GetQueuedCompletionStatus TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS ReleaseSemaphore ResumeThread GetNativeSystemInfo CreateSemaphoreA ConnectNamedPipe PeekNamedPipe CreateNamedPipeW CancelIoEx CancelSynchronousIo TerminateProcess GetExitCodeProcess UnregisterWaitEx LCMapStringW DebugBreak GetModuleHandleA GetStartupInfoW GetModuleFileNameA GetVersionExA GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask GetComputerNameA RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW GetStringTypeW GetStdHandle WriteConsoleW GetFinalPathNameByHandleW UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetStdHandle GetCommandLineA GetCommandLineW CreateThread ExitThread FreeLibraryAndExitThread GetDriveTypeW SystemTimeToTzSpecificLocalTime ExitProcess GetFileAttributesExW SetFileAttributesW GetConsoleCP CompareStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetTimeZoneInformation HeapSize SetEndOfFile FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetFileInformationByHandle InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx WaitForSingleObjectEx GetExitCodeThread SleepConditionVariableSRW EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo

user32

GetProcessWindowStation GetUserObjectInformationW ShowWindow GetLastInputInfo DispatchMessageA GetMessageA GetSystemMetrics MapVirtualKeyW TranslateMessage MessageBoxW

shell32

SHGetSpecialFolderPathA

ole32

CoInitializeEx CoCreateInstance CoUninitialize

advapi32

SystemFunction036 GetUserNameW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW QueryServiceConfigA DeleteService ControlService StartServiceW OpenServiceW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken LsaOpenPolicy LsaAddAccountRights LsaClose GetTokenInformation

bcrypt

BCryptGenRandom

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

62KB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

126KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=12, id=259, version=26715,

count=200, id=261, version=26715,

count=4, id=253, version=28518,

count=19, id=260, version=30034,

count=10, id=259, version=30034,

count=93, id=261, version=30034,

count=25, id=260, version=26715,

count=18, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,

count=21, id=257, version=26715,

count=373, id=1, productName=Unmarked objects,

count=31, id=260, productName=VS2019 v16.9.0 build 29910, version=29910,

count=564, id=260, productName=VS2019 v16.10.0 build 30037, version=30037,

count=276, id=265, version=30133,

count=3, id=259, productName=VS2019 v16.11.1 build 30133, version=30133,

count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,