xmrig | 2026-08-14_e13e47ba708d85a2474eedd53f215bdf_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_e13e47ba708d85a2474eedd53f215bdf_cobalt-strike_icedid_njrat_vidar
Size 837KB
Sample260814-2tkznscd93
SHA256 63dc7ce7b76ddc4cf02143d69f853bd84d0f6b18b5b9d6b6e54c7e334985fc51
MD5 e13e47ba708d85a2474eedd53f215bdf
SHA1 2de3bfc9ec5d324b334f0d339a8b67e68db8fd0c
SHA512 b422d68956b9bac6f1b71c0bef89f10136a988743124f5bf792d06171c3890e95ac02d43f604f8249da651ea2653cbfda0efbfe0bb50ea6d3ee87cc6cd789f71
SSDEEP 12288:GRnQi8Cxo1GCK0JmVdfRMc1nh1CZ9CvhDYbfLrVBNJACy1CGlKbqzE7DNibDK:4nDZoPqVh1a9iEVBNJACyMGYbe2
TLSH
T147058CACF69606F0C9778639C9A25E07E376745803A495EF1394026E6F233D1CA3EF52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_e13e47ba708d85a2474eedd53f215bdf_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-08-14_e13e47ba708d85a2474eedd53f215bdf_cobalt-strike_icedid_njrat_vidar

.exe 837KB

2026-08-14_e13e47ba708d85a2474eedd53f215bdf_cobalt-strike_icedid_njrat_vidar

IMPHASH 53c6f0d55ce0e2d963589577fad2d6c6
SHA256 63dc7ce7b76ddc4cf02143d69f853bd84d0f6b18b5b9d6b6e54c7e334985fc51
MD5 e13e47ba708d85a2474eedd53f215bdf
SHA1 2de3bfc9ec5d324b334f0d339a8b67e68db8fd0c
SHA512 b422d68956b9bac6f1b71c0bef89f10136a988743124f5bf792d06171c3890e95ac02d43f604f8249da651ea2653cbfda0efbfe0bb50ea6d3ee87cc6cd789f71
SSDEEP 12288:GRnQi8Cxo1GCK0JmVdfRMc1nh1CZ9CvhDYbfLrVBNJACy1CGlKbqzE7DNibDK:4nDZoPqVh1a9iEVBNJACyMGYbe2
TLSH
T147058CACF69606F0C9778639C9A25E07E376745803A495EF1394026E6F233D1CA3EF52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

368160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

gethostname connect WSACleanup __WSAFDIsSet accept send ntohs recv WSAPoll WSASetLastError WSAStartup select WSARecvFrom htonl bind WSAIoctl WSASend shutdown listen WSASocketW getsockname socket WSARecv ioctlsocket FreeAddrInfoW GetAddrInfoW closesocket getsockopt setsockopt WSAGetLastError htons

iphlpapi

GetAdaptersAddresses

kernel32

HeapReAlloc GetACP GetModuleFileNameA CompareStringW HeapFree HeapAlloc GetModuleHandleExW ExitThread SetFileAttributesW GetFileAttributesExW ExitProcess GetConsoleCP SetStdHandle GetStdHandle SetConsoleMode GetConsoleMode CloseHandle FreeConsole GetConsoleWindow SetThreadAffinityMask SetPriorityClass GetCurrentProcess SetThreadPriority GetCurrentThread GetProcAddress GetModuleHandleW VirtualFree VirtualAlloc LocalAlloc GetLastError LocalFree SetConsoleCtrlHandler EnterCriticalSection LeaveCriticalSection InitializeCriticalSection PostQueuedCompletionStatus Sleep SetErrorMode GetQueuedCompletionStatus CreateIoCompletionPort GetConsoleScreenBufferInfo SetConsoleTextAttribute RegisterWaitForSingleObject UnregisterWait GetConsoleCursorInfo CreateFileW DuplicateHandle QueueUserWorkItem MultiByteToWideChar SetConsoleCursorInfo FillConsoleOutputCharacterW ReadConsoleInputW CreateFileA ReadConsoleW WriteConsoleInputW FillConsoleOutputAttribute WriteConsoleW GetNumberOfConsoleInputEvents WideCharToMultiByte SetConsoleCursorPosition CreateDirectoryW ReadFile SetLastError WriteFile DeviceIoControl RemoveDirectoryW SetFileTime CreateHardLinkW GetFileAttributesW SetFilePointerEx MoveFileExW CopyFileW FlushFileBuffers GetLongPathNameW GetShortPathNameW GetCurrentDirectoryW ReadDirectoryChangesW GetFileType TlsSetValue ReleaseSemaphore WaitForMultipleObjects WaitForSingleObject ResumeThread SetEvent TlsAlloc ResetEvent DeleteCriticalSection CreateSemaphoreW TlsGetValue TlsFree CreateSemaphoreA CreateEventA CancelIo SetHandleInformation VerifyVersionInfoA GetModuleFileNameW QueryPerformanceFrequency GetSystemInfo GetCurrentProcessId QueryPerformanceCounter FormatMessageA DebugBreak SetNamedPipeHandleState CreateNamedPipeW PeekNamedPipe GetNamedPipeHandleStateA SwitchToThread ConnectNamedPipe GetModuleHandleA LoadLibraryA TerminateProcess UnregisterWaitEx LCMapStringW GetExitCodeProcess GetStartupInfoW InitializeCriticalSectionAndSpinCount GetCurrentThreadId GetTickCount64 RaiseException GetCommandLineW GetCommandLineA RtlPcToFileHeader RtlUnwindEx GetTimeZoneInformation HeapSize GetProcessHeap FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetStringTypeW DecodePointer GetFileInformationByHandle VerSetConditionMask CreateEventW GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead CreateThread EncodePointer GetThreadTimes FreeLibrary FreeLibraryAndExitThread LoadLibraryExW

user32

TranslateMessage ShowWindow DispatchMessageA MapVirtualKeyW GetMessageA

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken LsaOpenPolicy LsaAddAccountRights LsaClose GetTokenInformation