xmrig | 2026-10-13_e4f861665d0f530ad61dab9398d6468e_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_xmrig

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_e4f861665d0f530ad61dab9398d6468e_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_xmrig
Size 8.9MB
Sample261014-dms5psxxdv
SHA256 045db0be47659cc9ceec01bbf4b2e4c8d446ecee3a366077d470b83b06248aa3
MD5 e4f861665d0f530ad61dab9398d6468e
SHA1 704d5ea59302db80ad1a25f0eeb16c11cc123c58
SHA512 67eef0b3834be8afebc68a5fd37ec9bea722e5620a755f2f5d8bc0bece8bbf0a8c6798b9da9811e8e0bb79cd50eb2a875101f51bd3aa6e81376a9745df9fd268
SSDEEP 98304:twzwp2MRsCPp9LCBVEDb+F7qr3S4PtBrj5kmXQZxnQ/Dc662ba4s5YHaKZ7HyD0U:QZxQc6fba4oU7Hygt3Za7
TLSH
T113969D6AB7B420E8D86AC17CC656A507E7F2B8565370E6DB17B456BD1F23BD0023EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
sample	xmrig
sample	family_xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-13_e4f861665d0f530ad61dab9398d6468e_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_xmrig

File Explorer

2026-10-13_e4f861665d0f530ad61dab9398d6468e_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_xmrig

.exe 8.9MB

2026-10-13_e4f861665d0f530ad61dab9398d6468e_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_xmrig

SHA256 045db0be47659cc9ceec01bbf4b2e4c8d446ecee3a366077d470b83b06248aa3
MD5 e4f861665d0f530ad61dab9398d6468e
SHA1 704d5ea59302db80ad1a25f0eeb16c11cc123c58
SHA512 67eef0b3834be8afebc68a5fd37ec9bea722e5620a755f2f5d8bc0bece8bbf0a8c6798b9da9811e8e0bb79cd50eb2a875101f51bd3aa6e81376a9745df9fd268
SSDEEP 98304:twzwp2MRsCPp9LCBVEDb+F7qr3S4PtBrj5kmXQZxnQ/Dc662ba4s5YHaKZ7HyD0U:QZxQc6fba4oU7Hygt3Za7
TLSH
T113969D6AB7B420E8D86AC17CC656A507E7F2B8565370E6DB17B456BD1F23BD0023EB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4233456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

66KB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

182KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_e4f861665d0f530ad61dab9398d6468e_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_xmrig

generic