xmrig | 2026-08-02_fdf32073a799688ebc07d035b5b10119_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_fdf32073a799688ebc07d035b5b10119_cobalt-strike_icedid_njrat_vidar
Size 837KB
Sample260802-tgeccscc73
SHA256 230d90bab2110a51020119218b3b92d0ced2f4a48406b6191c58b636b18e5d18
MD5 fdf32073a799688ebc07d035b5b10119
SHA1 6a84a706160956780c0cdeb962924f558af443bf
SHA512 ef4e35a0db4a66dfd2d0cd5b7dc6b0a238aedf0829a2faeddc55f3859742432798f06259ba622c0119dfc220ff3c3ce09217102e83705937efc907a85b92856f
SSDEEP 12288:GRnQi8Cxo1GCK0JmVdfRMc1nh1CZ9CvhDYbfLrVBNJACy1CGlKbqzE7DNibDB:4nDZoPqVh1a9iEVBNJACyMGYbe9
TLSH
T159058CACF69606F0C9778639C9A25E07E376745803A495EF1394026E6F233D1CA3EF52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_fdf32073a799688ebc07d035b5b10119_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-08-02_fdf32073a799688ebc07d035b5b10119_cobalt-strike_icedid_njrat_vidar

.exe 837KB

2026-08-02_fdf32073a799688ebc07d035b5b10119_cobalt-strike_icedid_njrat_vidar

IMPHASH 53c6f0d55ce0e2d963589577fad2d6c6
SHA256 230d90bab2110a51020119218b3b92d0ced2f4a48406b6191c58b636b18e5d18
MD5 fdf32073a799688ebc07d035b5b10119
SHA1 6a84a706160956780c0cdeb962924f558af443bf
SHA512 ef4e35a0db4a66dfd2d0cd5b7dc6b0a238aedf0829a2faeddc55f3859742432798f06259ba622c0119dfc220ff3c3ce09217102e83705937efc907a85b92856f
SSDEEP 12288:GRnQi8Cxo1GCK0JmVdfRMc1nh1CZ9CvhDYbfLrVBNJACy1CGlKbqzE7DNibDB:4nDZoPqVh1a9iEVBNJACyMGYbe9
TLSH
T159058CACF69606F0C9778639C9A25E07E376745803A495EF1394026E6F233D1CA3EF52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

368160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

gethostname connect WSACleanup __WSAFDIsSet accept send ntohs recv WSAPoll WSASetLastError WSAStartup select WSARecvFrom htonl bind WSAIoctl WSASend shutdown listen WSASocketW getsockname socket WSARecv ioctlsocket FreeAddrInfoW GetAddrInfoW closesocket getsockopt setsockopt WSAGetLastError htons

iphlpapi

GetAdaptersAddresses

kernel32

HeapReAlloc GetACP GetModuleFileNameA CompareStringW HeapFree HeapAlloc GetModuleHandleExW ExitThread SetFileAttributesW GetFileAttributesExW ExitProcess GetConsoleCP SetStdHandle GetStdHandle SetConsoleMode GetConsoleMode CloseHandle FreeConsole GetConsoleWindow SetThreadAffinityMask SetPriorityClass GetCurrentProcess SetThreadPriority GetCurrentThread GetProcAddress GetModuleHandleW VirtualFree VirtualAlloc LocalAlloc GetLastError LocalFree SetConsoleCtrlHandler EnterCriticalSection LeaveCriticalSection InitializeCriticalSection PostQueuedCompletionStatus Sleep SetErrorMode GetQueuedCompletionStatus CreateIoCompletionPort GetConsoleScreenBufferInfo SetConsoleTextAttribute RegisterWaitForSingleObject UnregisterWait GetConsoleCursorInfo CreateFileW DuplicateHandle QueueUserWorkItem MultiByteToWideChar SetConsoleCursorInfo FillConsoleOutputCharacterW ReadConsoleInputW CreateFileA ReadConsoleW WriteConsoleInputW FillConsoleOutputAttribute WriteConsoleW GetNumberOfConsoleInputEvents WideCharToMultiByte SetConsoleCursorPosition CreateDirectoryW ReadFile SetLastError WriteFile DeviceIoControl RemoveDirectoryW SetFileTime CreateHardLinkW GetFileAttributesW SetFilePointerEx MoveFileExW CopyFileW FlushFileBuffers GetLongPathNameW GetShortPathNameW GetCurrentDirectoryW ReadDirectoryChangesW GetFileType TlsSetValue ReleaseSemaphore WaitForMultipleObjects WaitForSingleObject ResumeThread SetEvent TlsAlloc ResetEvent DeleteCriticalSection CreateSemaphoreW TlsGetValue TlsFree CreateSemaphoreA CreateEventA CancelIo SetHandleInformation VerifyVersionInfoA GetModuleFileNameW QueryPerformanceFrequency GetSystemInfo GetCurrentProcessId QueryPerformanceCounter FormatMessageA DebugBreak SetNamedPipeHandleState CreateNamedPipeW PeekNamedPipe GetNamedPipeHandleStateA SwitchToThread ConnectNamedPipe GetModuleHandleA LoadLibraryA TerminateProcess UnregisterWaitEx LCMapStringW GetExitCodeProcess GetStartupInfoW InitializeCriticalSectionAndSpinCount GetCurrentThreadId GetTickCount64 RaiseException GetCommandLineW GetCommandLineA RtlPcToFileHeader RtlUnwindEx GetTimeZoneInformation HeapSize GetProcessHeap FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetStringTypeW DecodePointer GetFileInformationByHandle VerSetConditionMask CreateEventW GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead CreateThread EncodePointer GetThreadTimes FreeLibrary FreeLibraryAndExitThread LoadLibraryExW

user32

TranslateMessage ShowWindow DispatchMessageA MapVirtualKeyW GetMessageA

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken LsaOpenPolicy LsaAddAccountRights LsaClose GetTokenInformation