xmrig | 2026-08-09_bff3afca05432f00da962dbc82d3fcc6_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_bff3afca05432f00da962dbc82d3fcc6_cobalt-strike_icedid_njrat_vidar
Size 837KB
Sample260809-thmp5a1eme
SHA256 a2220b0df01fc9c0f1e7507e6e44fbbb196cedba65407b616d75ec95008f661f
MD5 bff3afca05432f00da962dbc82d3fcc6
SHA1 30cc2804a3e763cf1eec1d68da546e097aa7bfec
SHA512 8601a51317bb199085890ce243e87985ff23ae5a3c2417b8dd1c59deb1854e3726592f7dceaff94239b04040bba39be7914446104566e5592e1f7dfd1e327b24
SSDEEP 12288:GRnQi8Cxo1GCK0JmVdfRMc1nh1CZ9CvhDYbfLrVBNJACy1CGlKbqzE7DNibDG:4nDZoPqVh1a9iEVBNJACyMGYbeS
TLSH
T1BC058CACF69606F0C9778639C9A25E07E376745803A495EF1394026E6F233D1CA3EF52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_bff3afca05432f00da962dbc82d3fcc6_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-08-09_bff3afca05432f00da962dbc82d3fcc6_cobalt-strike_icedid_njrat_vidar

.exe 837KB

2026-08-09_bff3afca05432f00da962dbc82d3fcc6_cobalt-strike_icedid_njrat_vidar

IMPHASH 53c6f0d55ce0e2d963589577fad2d6c6
SHA256 a2220b0df01fc9c0f1e7507e6e44fbbb196cedba65407b616d75ec95008f661f
MD5 bff3afca05432f00da962dbc82d3fcc6
SHA1 30cc2804a3e763cf1eec1d68da546e097aa7bfec
SHA512 8601a51317bb199085890ce243e87985ff23ae5a3c2417b8dd1c59deb1854e3726592f7dceaff94239b04040bba39be7914446104566e5592e1f7dfd1e327b24
SSDEEP 12288:GRnQi8Cxo1GCK0JmVdfRMc1nh1CZ9CvhDYbfLrVBNJACy1CGlKbqzE7DNibDG:4nDZoPqVh1a9iEVBNJACyMGYbeS
TLSH
T1BC058CACF69606F0C9778639C9A25E07E376745803A495EF1394026E6F233D1CA3EF52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

368160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

gethostname connect WSACleanup __WSAFDIsSet accept send ntohs recv WSAPoll WSASetLastError WSAStartup select WSARecvFrom htonl bind WSAIoctl WSASend shutdown listen WSASocketW getsockname socket WSARecv ioctlsocket FreeAddrInfoW GetAddrInfoW closesocket getsockopt setsockopt WSAGetLastError htons

iphlpapi

GetAdaptersAddresses

kernel32

HeapReAlloc GetACP GetModuleFileNameA CompareStringW HeapFree HeapAlloc GetModuleHandleExW ExitThread SetFileAttributesW GetFileAttributesExW ExitProcess GetConsoleCP SetStdHandle GetStdHandle SetConsoleMode GetConsoleMode CloseHandle FreeConsole GetConsoleWindow SetThreadAffinityMask SetPriorityClass GetCurrentProcess SetThreadPriority GetCurrentThread GetProcAddress GetModuleHandleW VirtualFree VirtualAlloc LocalAlloc GetLastError LocalFree SetConsoleCtrlHandler EnterCriticalSection LeaveCriticalSection InitializeCriticalSection PostQueuedCompletionStatus Sleep SetErrorMode GetQueuedCompletionStatus CreateIoCompletionPort GetConsoleScreenBufferInfo SetConsoleTextAttribute RegisterWaitForSingleObject UnregisterWait GetConsoleCursorInfo CreateFileW DuplicateHandle QueueUserWorkItem MultiByteToWideChar SetConsoleCursorInfo FillConsoleOutputCharacterW ReadConsoleInputW CreateFileA ReadConsoleW WriteConsoleInputW FillConsoleOutputAttribute WriteConsoleW GetNumberOfConsoleInputEvents WideCharToMultiByte SetConsoleCursorPosition CreateDirectoryW ReadFile SetLastError WriteFile DeviceIoControl RemoveDirectoryW SetFileTime CreateHardLinkW GetFileAttributesW SetFilePointerEx MoveFileExW CopyFileW FlushFileBuffers GetLongPathNameW GetShortPathNameW GetCurrentDirectoryW ReadDirectoryChangesW GetFileType TlsSetValue ReleaseSemaphore WaitForMultipleObjects WaitForSingleObject ResumeThread SetEvent TlsAlloc ResetEvent DeleteCriticalSection CreateSemaphoreW TlsGetValue TlsFree CreateSemaphoreA CreateEventA CancelIo SetHandleInformation VerifyVersionInfoA GetModuleFileNameW QueryPerformanceFrequency GetSystemInfo GetCurrentProcessId QueryPerformanceCounter FormatMessageA DebugBreak SetNamedPipeHandleState CreateNamedPipeW PeekNamedPipe GetNamedPipeHandleStateA SwitchToThread ConnectNamedPipe GetModuleHandleA LoadLibraryA TerminateProcess UnregisterWaitEx LCMapStringW GetExitCodeProcess GetStartupInfoW InitializeCriticalSectionAndSpinCount GetCurrentThreadId GetTickCount64 RaiseException GetCommandLineW GetCommandLineA RtlPcToFileHeader RtlUnwindEx GetTimeZoneInformation HeapSize GetProcessHeap FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetStringTypeW DecodePointer GetFileInformationByHandle VerSetConditionMask CreateEventW GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead CreateThread EncodePointer GetThreadTimes FreeLibrary FreeLibraryAndExitThread LoadLibraryExW

user32

TranslateMessage ShowWindow DispatchMessageA MapVirtualKeyW GetMessageA

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken LsaOpenPolicy LsaAddAccountRights LsaClose GetTokenInformation