xmrig | a2dcf467257237ebaa40d00279680e4e51ddb07bb2afd98c85dae74ca58679ed

General

Target
2026-07-27_c12051c90bd8d179cfeb16ac2028be2c_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc
Size 83.7MB
Sample260727-xdm2wack5s
SHA256 a2dcf467257237ebaa40d00279680e4e51ddb07bb2afd98c85dae74ca58679ed
MD5 c12051c90bd8d179cfeb16ac2028be2c
SHA1 308c6cee515fd9531dd8b1f519a9b6f7776b630a
SHA512 fd9c35fc8f1b5d407799934ee7d732fc06f6484fe80033e1c94c5c8e69713e8b7f79ca9637f01896c9377294612f819a9adeebf1d4f0f9c6228096dd2b0ad7ee
SSDEEP 1572864:z65lvMdU10m7KelfuIYGwzAzStFu0hI3Jf8Jl2pIAoPDV0M0B+wBKQ3Nr6ATMWwt:z65lP10m7KaftYZzvtFuZ3Jf8/2pIAaE
TLSH
T16718231BA19110E8C827C578C656A672E6B278134734B6EF0E65D7B10F33AD09F7E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-27_c12051c90bd8d179cfeb16ac2028be2c_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc
- Size 83.7MB
- SHA256 a2dcf467257237ebaa40d00279680e4e51ddb07bb2afd98c85dae74ca58679ed
- MD5 c12051c90bd8d179cfeb16ac2028be2c
- SHA1 308c6cee515fd9531dd8b1f519a9b6f7776b630a
- SHA512 fd9c35fc8f1b5d407799934ee7d732fc06f6484fe80033e1c94c5c8e69713e8b7f79ca9637f01896c9377294612f819a9adeebf1d4f0f9c6228096dd2b0ad7ee
- SSDEEP 1572864:z65lvMdU10m7KelfuIYGwzAzStFu0hI3Jf8Jl2pIAoPDV0M0B+wBKQ3Nr6ATMWwt:z65lP10m7KaftYZzvtFuZ3Jf8/2pIAaE
- TLSH
  T16718231BA19110E8C827C578C656A672E6B278134734B6EF0E65D7B10F33AD09F7E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

xmrig miner persistence upx
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: xmrig

UPX dump on OEP (original entry point)

XMRig Miner payload

Cryptocurrency Miner

Executes dropped EXE

Contacts third-party web service commonly abused for C2

Suspicious use of SetThreadContext

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2