xmrig | 6f0bb2b26e591fb98b28c3cceb4f1966310f325f3bac93f61eed55578bc8da66

General

Target
2026-09-17_856df572b0756022b3d87b604d16528d_cobalt-strike_glassworm_icedid_njrat_quasar-rat_vidar
Size 6.3MB
Sample260917-n449eaep2w
SHA256 6f0bb2b26e591fb98b28c3cceb4f1966310f325f3bac93f61eed55578bc8da66
MD5 856df572b0756022b3d87b604d16528d
SHA1 f8ea28469e1858d421a3601a05a72dc3ee2301e8
SHA512 199fa6d651b38030bedd40dad5995bf25f5b5255b77501694981d77274b86c58b41d57daa5729141157abe526d1d3648892b33c4b9c86af2ae3cd469d042c6cd
SSDEEP 49152:aaG5/sHX24v+b5yZ2FIBoxWzE1pcRYTyzkAVhMQVPL9dBpF0q/POariWYzvn/a6O:I6380ZFH/qSgsK5MoueRPS
TLSH
T1B5664A07A3F916D8E5B7C67886B65331DA72BC198720D7DF1164D21A1E32EE08D39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-17_856df572b0756022b3d87b604d16528d_cobalt-strike_glassworm_icedid_njrat_quasar-rat_vidar
- Size 6.3MB
- SHA256 6f0bb2b26e591fb98b28c3cceb4f1966310f325f3bac93f61eed55578bc8da66
- MD5 856df572b0756022b3d87b604d16528d
- SHA1 f8ea28469e1858d421a3601a05a72dc3ee2301e8
- SHA512 199fa6d651b38030bedd40dad5995bf25f5b5255b77501694981d77274b86c58b41d57daa5729141157abe526d1d3648892b33c4b9c86af2ae3cd469d042c6cd
- SSDEEP 49152:aaG5/sHX24v+b5yZ2FIBoxWzE1pcRYTyzkAVhMQVPL9dBpF0q/POariWYzvn/a6O:I6380ZFH/qSgsK5MoueRPS
- TLSH
  T1B5664A07A3F916D8E5B7C67886B65331DA72BC198720D7DF1164D21A1E32EE08D39B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution xmrig miner persistence
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Suspicious use of NtCreateUserProcessOtherParentProcess
- XMRig Miner payload
  miner
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: xmrig

Suspicious use of NtCreateUserProcessOtherParentProcess

XMRig Miner payload

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Executes dropped EXE

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2