xmrig | 2026-08-21_739c8abcc20ed89992210ba4782bc2e1_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc_vidar_xmrig

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_739c8abcc20ed89992210ba4782bc2e1_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc_vidar_xmrig
Size 4.2MB
Sample260821-e1kadshf22
SHA256 6d4485e99faec10d026d237e6cd9c034c6569117f1ccfe6546797b2c3f33d776
MD5 739c8abcc20ed89992210ba4782bc2e1
SHA1 ff6bde0c66709dc849852c68930d4303e526771b
SHA512 0f7a8aadd0986368955af2ce4e8d95fdd4b26af5a20e9f520663951badfca9bca84df3fc9d3121a69d93329ea1cc37e0e3ee7a4c9d698a391582e17bee928976
SSDEEP 98304:cPzeV/MsVgEr4kB9CItK6mIdnwzHmwhvLti6I:BLBwI06mIdnwzhhjk6
TLSH
T16A269E66BA9400F8D9BBC03DC9579503EBB2B86643B09BCF16A456790F236D15E3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
sample	xmrig
sample	family_xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_739c8abcc20ed89992210ba4782bc2e1_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc_vidar_xmrig

File Explorer

2026-08-21_739c8abcc20ed89992210ba4782bc2e1_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc_vidar_xmrig

.exe 4.2MB

2026-08-21_739c8abcc20ed89992210ba4782bc2e1_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc_vidar_xmrig

IMPHASH 92e0805811129ca643ef3a31c63cb14b
SHA256 6d4485e99faec10d026d237e6cd9c034c6569117f1ccfe6546797b2c3f33d776
MD5 739c8abcc20ed89992210ba4782bc2e1
SHA1 ff6bde0c66709dc849852c68930d4303e526771b
SHA512 0f7a8aadd0986368955af2ce4e8d95fdd4b26af5a20e9f520663951badfca9bca84df3fc9d3121a69d93329ea1cc37e0e3ee7a4c9d698a391582e17bee928976
SSDEEP 98304:cPzeV/MsVgEr4kB9CItK6mIdnwzHmwhvLti6I:BLBwI06mIdnwzhhjk6
TLSH
T16A269E66BA9400F8D9BBC03DC9579503EBB2B86643B09BCF16A456790F236D15E3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2716296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

shutdown ntohs recv select WSARecvFrom WSASocketW WSASend WSARecv WSAIoctl WSADuplicateSocketW htons getpeername FreeAddrInfoW GetAddrInfoW gethostname htonl socket setsockopt listen closesocket bind WSACleanup WSAStartup getsockopt getsockname ioctlsocket WSAGetLastError WSASetLastError send

psapi

GetProcessMemoryInfo

iphlpapi

GetAdaptersAddresses

userenv

GetUserProfileDirectoryW

crypt32

CertGetCertificateContextProperty CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore

kernel32

SetConsoleMode GetConsoleMode SizeofResource LockResource LoadResource FindResourceW ExpandEnvironmentStringsA MultiByteToWideChar SetPriorityClass GetCurrentProcess SetThreadPriority GetCurrentThread GetProcAddress GetModuleHandleW CloseHandle FreeConsole GetConsoleWindow VirtualProtect VirtualFree VirtualAlloc GetLargePageMinimum LocalAlloc GetLastError LocalFree FlushInstructionCache DeviceIoControl GetModuleFileNameW CreateFileW GetCurrentThreadId AddVectoredExceptionHandler SetLastError GetSystemTime SystemTimeToFileTime GetModuleHandleExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FindClose FindFirstFileW FindNextFileW WideCharToMultiByte GetFileType WriteFile ConvertFiberToThread ConvertThreadToFiber QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FreeLibrary LoadLibraryA LoadLibraryW GetEnvironmentVariableW ReadConsoleA ReadConsoleW CreateFileA DuplicateHandle PostQueuedCompletionStatus SetEvent ResetEvent WaitForSingleObject CreateEventA Sleep QueueUserWorkItem RegisterWaitForSingleObject UnregisterWait GetNumberOfConsoleInputEvents ReadConsoleInputW WriteConsoleW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW VerSetConditionMask GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle SetConsoleTitleA GetCurrentDirectoryW GetTempPathW QueryPerformanceFrequency InitializeCriticalSection GlobalMemoryStatusEx GetSystemInfo GetVersionExW VerifyVersionInfoA FileTimeToSystemTime CreateDirectoryW FlushFileBuffers GetDiskFreeSpaceW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFinalPathNameByHandleW GetFullPathNameW ReadFile RemoveDirectoryW SetFilePointerEx SetFileTime MapViewOfFile FlushViewOfFile UnmapViewOfFile RtlUnwind ReOpenFile CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW SetConsoleCtrlHandler GetLongPathNameW GetShortPathNameW CreateIoCompletionPort ReadDirectoryChangesW SetHandleInformation CancelIo SetFileCompletionNotificationModes LoadLibraryExW FormatMessageA SetErrorMode GetQueuedCompletionStatus ConnectNamedPipe PeekNamedPipe CreateNamedPipeW CancelIoEx CancelSynchronousIo SwitchToThread TerminateProcess GetExitCodeProcess UnregisterWaitEx LCMapStringW DebugBreak TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS ReleaseSemaphore ResumeThread GetNativeSystemInfo CreateSemaphoreA GetModuleHandleA GetStartupInfoW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetNumaHighestNodeNumber SetCurrentDirectoryW GetThreadTimes FreeLibraryAndExitThread InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList RtlUnwindEx RtlPcToFileHeader RaiseException GetCommandLineA GetCommandLineW ExitThread GetDriveTypeW SystemTimeToTzSpecificLocalTime ExitProcess SetStdHandle GetFileAttributesExW SetFileAttributesW GetConsoleCP HeapReAlloc HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation HeapSize SetEndOfFile FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetProcessHeap SetEnvironmentVariableW CreateFileMappingA RtlVirtualUnwind RtlLookupFunctionEntry WaitForSingleObjectEx GetExitCodeThread EncodePointer DecodePointer GetCPInfo CreateEventW GetTickCount CompareStringW GetLocaleInfoW GetStringTypeW RtlCaptureContext

user32

GetSystemMetrics MapVirtualKeyW DispatchMessageA TranslateMessage GetMessageA MessageBoxW GetUserObjectInformationW GetProcessWindowStation ShowWindow

shell32

SHGetSpecialFolderPathA

advapi32

SystemFunction036 GetUserNameW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW QueryServiceConfigA DeleteService ControlService StartServiceW OpenServiceW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken LsaOpenPolicy LsaAddAccountRights LsaClose GetTokenInformation

bcrypt

BCryptGenRandom

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

858KB

Virtual Size

857KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

298KB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_SHA3_25

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_739c8abcc20ed89992210ba4782bc2e1_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc_vidar_xmrig

ws2_32

psapi

iphlpapi

userenv

crypt32

kernel32

user32

shell32

advapi32

bcrypt

generic