xmrig | 2026-09-09_d5c3426455e8e215d170d39605997ecd_glassworm_icedid_njrat_stealc_vidar_xmrig

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-09_d5c3426455e8e215d170d39605997ecd_glassworm_icedid_njrat_stealc_vidar_xmrig
Size 1.4MB
Sample260910-2yhecaxbra
SHA256 67bad3ac0fb471783fa7754a215ca24fab50020810c49ee1005421647d15c5d4
MD5 d5c3426455e8e215d170d39605997ecd
SHA1 dac8fe1f6d799d537181f16c8cdf5545d6c45dfb
SHA512 a2443946d119f7eca3fb0dd50bac84eeece5aab1aabe8e2175943c34d6a1d267de50141671798edd9816afa3368d8744d01963b63ef1ab1fa2aa3fc1642ad461
SSDEEP 24576:UOdPgMmv+m5xbSIJU45owbIydiIC5kNVOChPpfZbgYWGV6eyEaL6WTTDfHijA8Rg:UZWAbPoOIydHC5kNoYBum6eyEaL6WTTN
TLSH
T1CD657D6DA29940F5C6AFC178C91B894FF7F17849437495EB02A157A92F237C0CA3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
sample	xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-09_d5c3426455e8e215d170d39605997ecd_glassworm_icedid_njrat_stealc_vidar_xmrig

File Explorer

2026-09-09_d5c3426455e8e215d170d39605997ecd_glassworm_icedid_njrat_stealc_vidar_xmrig

.exe 1.4MB

2026-09-09_d5c3426455e8e215d170d39605997ecd_glassworm_icedid_njrat_stealc_vidar_xmrig

IMPHASH 66992efd7f4ec24cf94ec62996d402c0
SHA256 67bad3ac0fb471783fa7754a215ca24fab50020810c49ee1005421647d15c5d4
MD5 d5c3426455e8e215d170d39605997ecd
SHA1 dac8fe1f6d799d537181f16c8cdf5545d6c45dfb
SHA512 a2443946d119f7eca3fb0dd50bac84eeece5aab1aabe8e2175943c34d6a1d267de50141671798edd9816afa3368d8744d01963b63ef1ab1fa2aa3fc1642ad461
SSDEEP 24576:UOdPgMmv+m5xbSIJU45owbIydiIC5kNVOChPpfZbgYWGV6eyEaL6WTTDfHijA8Rg:UZWAbPoOIydHC5kNoYBum6eyEaL6WTTN
TLSH
T1CD657D6DA29940F5C6AFC178C91B894FF7F17849437495EB02A157A92F237C0CA3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

576100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSAGetLastError WSASetLastError WSAStartup select WSARecvFrom bind WSAIoctl closesocket WSASend shutdown WSASocketW socket WSARecv getsockopt ioctlsocket setsockopt FreeAddrInfoW GetAddrInfoW htonl htons

kernel32

SetStdHandle ExitThread GetCommandLineW ExitProcess GetModuleHandleExW GetConsoleCP GetDriveTypeW GetCommandLineA RaiseException GetStdHandle SetConsoleMode GetConsoleMode GetModuleFileNameW CreateMutexW Sleep GetLastError MultiByteToWideChar SetThreadAffinityMask SetPriorityClass GetCurrentProcess SetThreadPriority GetCurrentThread GetProcAddress GetModuleHandleW CloseHandle FreeConsole GetConsoleWindow VirtualProtect VirtualFree VirtualAlloc GetLargePageMinimum LocalAlloc LocalFree FlushInstructionCache GetFileType GetConsoleScreenBufferInfo SetConsoleTextAttribute RegisterWaitForSingleObject UnregisterWait GetConsoleCursorInfo CreateFileW DuplicateHandle PostQueuedCompletionStatus QueueUserWorkItem SetConsoleCursorInfo FillConsoleOutputCharacterW ReadConsoleInputW CreateFileA ReadConsoleW WriteConsoleInputW FillConsoleOutputAttribute WriteConsoleW GetNumberOfConsoleInputEvents WideCharToMultiByte SetConsoleCursorPosition EnterCriticalSection SetEnvironmentVariableW LeaveCriticalSection InitializeCriticalSection GetVersionExW FreeEnvironmentStringsW FileTimeToSystemTime QueryPerformanceFrequency GetSystemInfo GetCurrentDirectoryW GetCurrentProcessId GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW SystemTimeToTzSpecificLocalTime SetConsoleCtrlHandler CancelIo SetHandleInformation CreateEventA CreateIoCompletionPort SetFileCompletionNotificationModes SetErrorMode GetQueuedCompletionStatus GetQueuedCompletionStatusEx SleepConditionVariableCS TryEnterCriticalSection TlsSetValue ReleaseSemaphore WakeConditionVariable InitializeConditionVariable WaitForSingleObject ResumeThread SetEvent TlsAlloc GetNativeSystemInfo DeleteCriticalSection CreateSemaphoreW TlsGetValue TlsFree CreateSemaphoreA GetLongPathNameW ReadDirectoryChangesW ReadFile SetNamedPipeHandleState SetLastError WriteFile CreateNamedPipeW RtlUnwind CancelSynchronousIo GetNamedPipeHandleStateA CancelIoEx SwitchToThread ConnectNamedPipe FlushFileBuffers TerminateProcess UnregisterWaitEx LCMapStringW GetExitCodeProcess GetModuleHandleA LoadLibraryA FormatMessageA DebugBreak GetFileSizeEx FindNextFileW FindClose GetFileInformationByHandle SetFilePointerEx GetStartupInfoW GetProcessAffinityMask SetProcessAffinityMask RtlPcToFileHeader RtlUnwindEx LoadLibraryW QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList HeapReAlloc HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation HeapSize GetFullPathNameW SetEndOfFile FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetProcessHeap PeekNamedPipe GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionAndSpinCount CreateEventW GetTickCount EncodePointer DecodePointer CompareStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead CreateTimerQueue SignalObjectAndWait CreateThread GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetThreadTimes FreeLibrary FreeLibraryAndExitThread LoadLibraryExW

user32

GetMessageA TranslateMessage ShowWindow GetSystemMetrics DispatchMessageA MapVirtualKeyW

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken LsaOpenPolicy LsaAddAccountRights LsaClose GetTokenInformation

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

217KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-09_d5c3426455e8e215d170d39605997ecd_glassworm_icedid_njrat_stealc_vidar_xmrig

ws2_32

kernel32

user32

advapi32

generic