xmrig | 2026-08-20_9777eee0df7acfdd78b56b53f1236f36_coinminer_glassworm_icedid_njrat_vidar_xmrig

resource	yara_rule
sample	xmrig
static1/unpack001/.rdata	xmrig

resource
2026-08-20_9777eee0df7acfdd78b56b53f1236f36_coinminer_glassworm_icedid_njrat_vidar_xmrig

2026-08-20_9777eee0df7acfdd78b56b53f1236f36_coinminer_glassworm_icedid_njrat_vidar_xmrig

SHA256 8733ec9bdcdbec445ff4cde0bde6c0b2b317cefa142ecb2a4a7506acd244ef97
MD5 9777eee0df7acfdd78b56b53f1236f36
SHA1 078d58e73187ff8e2f295ebfdb696e224ba3d7f2
SHA512 efcb8259685804e26746ecadfc1b47c6f89c5bc42eef3bd1c46b3e2215a12bed74986c7118fd7d84964bf3737d0db5cbcde485753b5ec6e6ff1a3c0c89ff6092
SSDEEP 49152:chHe26va1A+yJSpydPaW6C5EDKMkPyWgBFeCdCzVFNVJV/v+csVnldzYeysBsQr4:cMPacEXkPZgBHdCzVTVJV/v+csVnldzU
TLSH
T1C8C5BF6972A580F4C67BC538CD03AA46F7713C0A437496EB16B4226D1F3B7E18A3DB25
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

887684

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

373KB

Virtual Size

373KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

253KB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

128KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

.data

SHA256 a8347c1ce7f553880408dfb26867ab5c25dfd52985d4bdce9296bacd426ba04d
MD5 3ada024a5d000b594d08212e3ae7993a
SHA1 5fc8ca02a0b7c1806d78d24cb92b4d62008de496
SHA512 6258a47969ddd5d99460036a191d4b15e1f2a973d4c87d286eec81576f19a5ecb3a03388a815f6f5bf0f8d4fc93dfcff71d13f11be050381c3280a980c265228
SSDEEP 3072:usM3XA2oaMUJPQzfD8Osms8W+nO35OhjhbzM18NF3fhB++B7BgFGXMp:xM3XUtzYOrNZVs83fHFgF2u
TLSH
T160441BA03A015802DCE789BD7B473651E15BDCA3B1CA9AD7AD7C288C09097B445F92FF
MD5 SHA1 SHA512 SSDEEP TLSH

XMRig Miner payload

miner

.pdata

SHA256 62a391ca9a41ded7576549077cdfb5d7f2220dab7c19c146be6783a3aefc26b3
MD5 aaa7c8715b199e34b91776845cc9357f
SHA1 9535ec27ceedb914dc3dd907a5d053662e85fc17
SHA512 4b409c10d30f94d6f4872721a52b8a39c2955a3931d4708eec9c6ded15b666756dcd4d31561f795dedc071ed089ec08ea0487088d698ffe078ee05253ccb0444
SSDEEP 1536:26ty/3E4oaM+KGSxwVED473+1uJml18o7+he8W3k7Gmc89:2yzaMhs2D4GuJmlLKhN
TLSH
T1FA532A67B76F8FE8E95B07F8D44014A6557C14A5EFE55D88230C031D324BA2AE38A27F
MD5 SHA1 SHA512 SSDEEP TLSH

XMRig Miner payload

miner

.rdata

SHA256 5e0b0090fda7ac6fdb058790c30cf8ce2381be851c496abf0389aa6cd72f814a
MD5 878e33db7832d0c36660b2a6191c2943
SHA1 9277198d72ffc0ff5bb81c77ad752291f16a9048
SHA512 b5e0c9e29fe9a1c5f34a9e2d063d752494597599f090e5cd7a9abb0d4b2b3a68c65afa4d151889bd89217fae19be7639729b00345b1f0f4bda5076db890e189e
SSDEEP 6144:DEgVdGohIk3LMLNqqDz5q0ZlDL77vnTBkVn:DEg6or7vqJq0ZRTTBk
TLSH
T1E4844C567B56CAE1D413C33C8C548BC23A73E654AF71373B268CA20D2D7A2AE4E11677
MD5 SHA1 SHA512 SSDEEP TLSH

XMRig Miner payload

miner

.text

SHA256 e4574be7ec8c68fa6b27b8288402680196268df102f9a8353ce2d8b782f5fb62
MD5 6034cbb4ad9c247b0b5c26ad2b1c5a60
SHA1 1538ad794db48a13990c452d3ef766a03066e765
SHA512 cab05121104fba56108bc013bc3b40855f50085eef557ffb4efb8803862073825de2e4a69e620605a060ac4d379db67e31bdf4195160ec812bd10479fb7da9d9
SSDEEP 49152:ThHe26va1A+yJSpydPaW6C5EDKMkPyWgBFeCdCzVFNVJV/v+csVnldzYeysBsQry:TMPacEXkPZgBHdCzVTVJV/v+csVnldz/
TLSH
T125957D6D62A550F8C57FD078C9478947F7B0340A0378A6EB42B046AA5F37BE5823DF61
MD5 SHA1 SHA512 SSDEEP TLSH

XMRig Miner payload

miner

_RANDOMX

SHA256 f01e923b72de002b208945d18741cad5bb07acf12806ff7b4e19369933f7bd05
MD5 d9024f8fd040694ff6e16174a3240aca
SHA1 9d597f3cc3beafbe630a11e0512351c5753f58c2
SHA512 49fc39d034d7abac06a256a912f9d7f7b32c192726d38cef97208d24e90bb0b1fd18e3a01da8dffef7bb1bb51ee8117a47e5c8ff00c5550dcca8f8d75aaabd2a
TLSH
T12D31EE247512F4DDF64B063ED4F80CC9740DC999060BBDB9C1E4C33CA0B2D0046B0AE5
MD5 SHA1 SHA512 TLSH

XMRig Miner payload

miner

_TEXT_CN

SHA256 7682a937b3193b26b97f1f56a631fdee93289b69ecfefc926a95ebd8b8a38732
MD5 6a7f77e47f77f65bef85036ae5a71106
SHA1 317201314b5f3e12f88eacef2a87bc8dad03a6ed
SHA512 d2887d682f1a5aa1357b594c4d57d4097d0054fc3c8ea85eea09b5399299988ce29dd4a33b77be991fee501c9f8d443e0e63c671cfd1512f6974abd03a4fd32c
SSDEEP 96:wW2RqNNyIeHsyMFoa5bts+RlFpoM5aQuULy85dpejfH4ch+Q2RKNNJeg4ULy85dF:30IeDuwVQuydYjP4GTreg4ydfcrmwa
TLSH
T1CBD1A80F7443B4F9FB8AE87B8577AB93F350D3DB6389686681E2D07A5A035D0C465E02
MD5 SHA1 SHA512 SSDEEP TLSH

XMRig Miner payload

miner

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_9777eee0df7acfdd78b56b53f1236f36_coinminer_glassworm_icedid_njrat_vidar_xmrig

generic

.data

.pdata

.rdata

.text

_RANDOMX

_TEXT_CN