xmrig | 2026-08-22_b7aedd4467b88b727c10e1f8d2b4a5b3_azorult_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat_xmrig

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_b7aedd4467b88b727c10e1f8d2b4a5b3_azorult_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat_xmrig
Size 13.2MB
Sample260823-b945da1gra
SHA256 427b4808ae042932f399868ad3fc2a23b567898250a552cbc0d2fb66dee40389
MD5 b7aedd4467b88b727c10e1f8d2b4a5b3
SHA1 6d3113fb7a1f236240df6d2ff3e2de4402443522
SHA512 339ee590009a53511a2f4d4f408b86a32014095aba5d6348ef75aecfeb1456415ded8ed6a895dbf7e763d9ec65cac14759e486af9417b8e678b8968c60e784d0
SSDEEP 196608:ZAfrMK0z50OJEzEuDTvnO5tQ3ovumrGXp66t1:ZYYKXS1uDaOZmry6M
TLSH
T15BD67C27F5A304FDC67ED17082979732BA3178A942307BAB1B90DA752F12F906B2D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner upx xmrig loader privateloader

Malware Config

Signatures

Family: PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	xmrig

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_b7aedd4467b88b727c10e1f8d2b4a5b3_azorult_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat_xmrig

File Explorer

2026-08-22_b7aedd4467b88b727c10e1f8d2b4a5b3_azorult_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat_xmrig

.exe 13.2MB

2026-08-22_b7aedd4467b88b727c10e1f8d2b4a5b3_azorult_cobalt-strike_coinminer_glassworm_poet-rat_quasar-rat_xmrig

SHA256 427b4808ae042932f399868ad3fc2a23b567898250a552cbc0d2fb66dee40389
MD5 b7aedd4467b88b727c10e1f8d2b4a5b3
SHA1 6d3113fb7a1f236240df6d2ff3e2de4402443522
SHA512 339ee590009a53511a2f4d4f408b86a32014095aba5d6348ef75aecfeb1456415ded8ed6a895dbf7e763d9ec65cac14759e486af9417b8e678b8968c60e784d0
SSDEEP 196608:ZAfrMK0z50OJEzEuDTvnO5tQ3ovumrGXp66t1:ZYYKXS1uDaOZmry6M
TLSH
T15BD67C27F5A304FDC67ED17082979732BA3178A942307BAB1B90DA752F12F906B2D714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
UPX dump on OEP (original entry point)
XMRig Miner payload

miner
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths