xmrig | 2026-07-30_89fc7e56945342f2451d577e36b7ac51_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_89fc7e56945342f2451d577e36b7ac51_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig
Size 9.8MB
Sample260730-dq4evaybmf
SHA256 29c057bd9864c15c4125fd576bb77c38b7d06de5212156bf57d474918bf5494e
MD5 89fc7e56945342f2451d577e36b7ac51
SHA1 3bcbb4cf3a166804fc05e0d33b5b57eb4c0ef7e2
SHA512 e3a63f4a8f706bcb893dcf11b80a6c6f75c387d5bb843443f36bb3652930fef8dfef813d6a69b7717dcf82d5b61bfa1e88c5919f0cdeb5624cc6894f4163dc2b
SSDEEP 196608:m/II/6aYXdFD22VatktKpEEd1Qiw1J+46eK/PZAWNsy3RXFJlOauJ1J+46e:mkFCUatKWEe6J+FeK/Ra+UbJ+Fe
TLSH
T193A6BF16B7A401E8C86AC538C6469633E7B1B8195374A7CF26F4D66A1F33BD04E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
sample	xmrig
sample	family_xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_89fc7e56945342f2451d577e36b7ac51_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

File Explorer

2026-07-30_89fc7e56945342f2451d577e36b7ac51_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

.exe 9.8MB

2026-07-30_89fc7e56945342f2451d577e36b7ac51_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

IMPHASH 8a12a6503a1939d916fdd9edd3a831f4
SHA256 29c057bd9864c15c4125fd576bb77c38b7d06de5212156bf57d474918bf5494e
MD5 89fc7e56945342f2451d577e36b7ac51
SHA1 3bcbb4cf3a166804fc05e0d33b5b57eb4c0ef7e2
SHA512 e3a63f4a8f706bcb893dcf11b80a6c6f75c387d5bb843443f36bb3652930fef8dfef813d6a69b7717dcf82d5b61bfa1e88c5919f0cdeb5624cc6894f4163dc2b
SSDEEP 196608:m/II/6aYXdFD22VatktKpEEd1Qiw1J+46eK/PZAWNsy3RXFJlOauJ1J+46e:mkFCUatKWEe6J+FeK/Ra+UbJ+Fe
TLSH
T193A6BF16B7A401E8C86AC538C6469633E7B1B8195374A7CF26F4D66A1F33BD04E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4861

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA RegCloseKey RegOpenKeyExA RegSetValueExA

kernel32

AddVectoredExceptionHandler CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateMutexA CreateProcessA CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DuplicateHandle EnterCriticalSection FindResourceA FormatMessageA GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetFileAttributesA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GetVolumeInformationA GetWindowsDirectoryA GlobalMemoryStatusEx InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW RaiseException ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryA SetEvent SetFileAttributesA SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _fstat64 _initterm _ismbblead _lseeki64 _onexit _setjmp _ultoa _vsnprintf _wcsicmp _wfopen abort calloc exit fclose fflush fgetwc fopen fprintf fputc fputs free getc getenv isalnum iswctype localeconv longjmp malloc memchr memcmp memcpy memmove printf rand realloc setlocale setvbuf signal srand strchr strcmp strcoll strcpy strerror strftime strlen strncmp strtol strtoul strxfrm tan tolower toupper towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm _vsnwprintf _write _strdup _read _fileno _fdopen

shell32

ShellExecuteA

wininet

HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetOpenUrlA InternetReadFile InternetSetOptionA

Name

.text

Size

524KB

Virtual Size

523KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9.1MB

Virtual Size

9.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_89fc7e56945342f2451d577e36b7ac51_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig

advapi32

kernel32

msvcrt

shell32

wininet

generic