xmrig | 2026-07-16_469ecd4af6341521abc5f21d07a4d260_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-16_469ecd4af6341521abc5f21d07a4d260_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig
Size 10.4MB
Sample260716-n12n4sf14v
SHA256 de41557c477c24c9ab23fef6e8bedce393184868afafa45dd1b663269d96056d
MD5 469ecd4af6341521abc5f21d07a4d260
SHA1 6af7612e68df3224458cc9f3c63a538ed092ecb7
SHA512 a028cfb02973c19846ccea33072255388d76864d9289fafceacbc343b10bbfb8fdae4d094f30cbcc43c79dabd04530eba33177083428aa3c7321d2dfd15f8fc4
SSDEEP 196608:y/II/6aYXdFD22VatktKpEEd1Qiw1J+46eK/PZAWNsy3RuJmRh51J+46e+whbowd:ykFCUatKWEe6J+FeK/Ra+uJmfrJ+Fe+0
TLSH
T11EB6CF16B7A441E8C87AC538C64A9633E7B1B8195374A7CF26F4D2691F23BD04E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
sample	xmrig
sample	family_xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-16_469ecd4af6341521abc5f21d07a4d260_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

File Explorer

2026-07-16_469ecd4af6341521abc5f21d07a4d260_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

.exe 10.4MB

2026-07-16_469ecd4af6341521abc5f21d07a4d260_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

IMPHASH 8a12a6503a1939d916fdd9edd3a831f4
SHA256 de41557c477c24c9ab23fef6e8bedce393184868afafa45dd1b663269d96056d
MD5 469ecd4af6341521abc5f21d07a4d260
SHA1 6af7612e68df3224458cc9f3c63a538ed092ecb7
SHA512 a028cfb02973c19846ccea33072255388d76864d9289fafceacbc343b10bbfb8fdae4d094f30cbcc43c79dabd04530eba33177083428aa3c7321d2dfd15f8fc4
SSDEEP 196608:y/II/6aYXdFD22VatktKpEEd1Qiw1J+46eK/PZAWNsy3RuJmRh51J+46e+whbowd:ykFCUatKWEe6J+FeK/Ra+uJmfrJ+Fe+0
TLSH
T11EB6CF16B7A441E8C87AC538C64A9633E7B1B8195374A7CF26F4D2691F23BD04E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4861

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA RegCloseKey RegOpenKeyExA RegSetValueExA

kernel32

AddVectoredExceptionHandler CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateMutexA CreateProcessA CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DuplicateHandle EnterCriticalSection FindResourceA FormatMessageA GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetFileAttributesA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GetVolumeInformationA GetWindowsDirectoryA GlobalMemoryStatusEx InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW RaiseException ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryA SetEvent SetFileAttributesA SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _fstat64 _initterm _ismbblead _lseeki64 _onexit _setjmp _ultoa _vsnprintf _wcsicmp _wfopen abort calloc exit fclose fflush fgetwc fopen fprintf fputc fputs free getc getenv isalnum iswctype localeconv longjmp malloc memchr memcmp memcpy memmove printf rand realloc setlocale setvbuf signal srand strchr strcmp strcoll strcpy strerror strftime strlen strncmp strtol strtoul strxfrm tan tolower toupper towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm _vsnwprintf _write _strdup _read _fileno _fdopen

shell32

ShellExecuteA

wininet

HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetOpenUrlA InternetReadFile InternetSetOptionA

Name

.text

Size

524KB

Virtual Size

523KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8.9MB

Virtual Size

8.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-16_469ecd4af6341521abc5f21d07a4d260_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

advapi32

kernel32

msvcrt

shell32

wininet

generic