xmrig | 2026-10-06_93e80cd482d2f63302bf7a92307c3ec7_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_xmrig

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-06_93e80cd482d2f63302bf7a92307c3ec7_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_xmrig
Size 8.9MB
Sample261007-29pmssg18p
SHA256 cb35aa7c81495675526f1bfe5a0edeaeab66d32858c5d777274e5c12b0bed2d1
MD5 93e80cd482d2f63302bf7a92307c3ec7
SHA1 dfe883e8b6d19117e6b75f5b473b201d0636513d
SHA512 1d435c99dde11c317343d0696bbdbba1a7e406e4655dcf3a3e29d91e44120d3ec3e69012c213ce1e2807afeb11296e79a064a7a1a2da99822b09e37fa58b5d73
SSDEEP 98304:9wzwp2MRsCPp9LCBVEDb+F7qr3S4PtBrj5kmXQZxnQ/Dc662ba4s5YHaKZ7lyTAQ:gZxQc6fba4oU7lyMZdh07
TLSH
T1B4968D66B7A400A8F86AC13CC656A607E7F2B8D55370A6DB17B4D76D1F23BD0123EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
sample	xmrig
sample	family_xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-06_93e80cd482d2f63302bf7a92307c3ec7_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_xmrig

File Explorer

2026-10-06_93e80cd482d2f63302bf7a92307c3ec7_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_xmrig

.exe 8.9MB

2026-10-06_93e80cd482d2f63302bf7a92307c3ec7_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_xmrig

SHA256 cb35aa7c81495675526f1bfe5a0edeaeab66d32858c5d777274e5c12b0bed2d1
MD5 93e80cd482d2f63302bf7a92307c3ec7
SHA1 dfe883e8b6d19117e6b75f5b473b201d0636513d
SHA512 1d435c99dde11c317343d0696bbdbba1a7e406e4655dcf3a3e29d91e44120d3ec3e69012c213ce1e2807afeb11296e79a064a7a1a2da99822b09e37fa58b5d73
SSDEEP 98304:9wzwp2MRsCPp9LCBVEDb+F7qr3S4PtBrj5kmXQZxnQ/Dc662ba4s5YHaKZ7lyTAQ:gZxQc6fba4oU7lyMZdh07
TLSH
T1B4968D66B7A400A8F86AC13CC656A607E7F2B8D55370A6DB17B4D76D1F23BD0123EB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4233456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

66KB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

182KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-06_93e80cd482d2f63302bf7a92307c3ec7_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_xmrig

generic