xmrig | 2026-11-10_e1ca17d6b6e82aad0087ba16e9e26ce3_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc_vidar_xmrig

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-10_e1ca17d6b6e82aad0087ba16e9e26ce3_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc_vidar_xmrig
Size 2.4MB
Sample261110-fnvq2ada33
SHA256 e6068e5af75853ad982385344a8ec56ab53d8c27b63fac634a4d2273f703fd93
MD5 e1ca17d6b6e82aad0087ba16e9e26ce3
SHA1 aac71e2cf6cfeed3c46a4806e0af4f945b5b30b0
SHA512 60a58bd2b32a267c324f2fec6937ef5a6e77684566000a135d3999ab4efa53b4ef2d12f4a9337fe6a7a48df42d0a27f6764599ff086449bba28e2de1e92f806d
SSDEEP 49152:pWpSgQ50Z4Lk2VaM6VLEeAgbhKJPNxjGeNNRsPR81pN:pRk2VaM6VLEVgcJPN/RGRcpN
TLSH
T162B58D3AF26540E9D5BBC03C8A0F9506F7B27C568374A6DB12E4139D1F27AD049BAF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

miner xmrig

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
sample	xmrig
sample	family_xmrig

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-10_e1ca17d6b6e82aad0087ba16e9e26ce3_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc_vidar_xmrig

File Explorer

2026-11-10_e1ca17d6b6e82aad0087ba16e9e26ce3_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc_vidar_xmrig

.exe 2.4MB

2026-11-10_e1ca17d6b6e82aad0087ba16e9e26ce3_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc_vidar_xmrig

IMPHASH 25f32da901e57d48b6ffe18a0075242d
SHA256 e6068e5af75853ad982385344a8ec56ab53d8c27b63fac634a4d2273f703fd93
MD5 e1ca17d6b6e82aad0087ba16e9e26ce3
SHA1 aac71e2cf6cfeed3c46a4806e0af4f945b5b30b0
SHA512 60a58bd2b32a267c324f2fec6937ef5a6e77684566000a135d3999ab4efa53b4ef2d12f4a9337fe6a7a48df42d0a27f6764599ff086449bba28e2de1e92f806d
SSDEEP 49152:pWpSgQ50Z4Lk2VaM6VLEeAgbhKJPNxjGeNNRsPR81pN:pRk2VaM6VLEVgcJPN/RGRcpN
TLSH
T162B58D3AF26540E9D5BBC03C8A0F9506F7B27C568374A6DB12E4139D1F27AD049BAF21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

XMRig Miner payload

miner
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1454844

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

ntohs WSASetLastError WSAStartup select WSARecvFrom bind WSAIoctl closesocket WSASend shutdown listen WSASocketW getpeername getsockname socket WSARecv getsockopt ioctlsocket setsockopt FreeAddrInfoW GetAddrInfoW gethostname htonl WSAGetLastError htons

psapi

GetProcessMemoryInfo

iphlpapi

GetAdaptersAddresses

kernel32

GetCommandLineA GetCommandLineW ExitThread GetModuleHandleExW RaiseException RtlPcToFileHeader SetConsoleTitleA GetStdHandle SetConsoleMode GetConsoleMode SizeofResource LockResource LoadResource FindResourceW ExpandEnvironmentStringsA MultiByteToWideChar SetPriorityClass GetCurrentProcess SetThreadPriority GetCurrentThread GetProcAddress GetModuleHandleW CloseHandle FreeConsole GetConsoleWindow VirtualProtect VirtualFree VirtualAlloc GetLargePageMinimum LocalAlloc GetLastError LocalFree FlushInstructionCache DeviceIoControl GetModuleFileNameW CreateFileW GetCurrentThreadId AddVectoredExceptionHandler GetFileType GetConsoleScreenBufferInfo SetConsoleTextAttribute RegisterWaitForSingleObject UnregisterWait GetConsoleCursorInfo WaitForSingleObject DuplicateHandle PostQueuedCompletionStatus QueueUserWorkItem Sleep SetConsoleCursorInfo FillConsoleOutputCharacterW ReadConsoleInputW CreateFileA SetEvent ReadConsoleW ResetEvent WriteConsoleInputW FillConsoleOutputAttribute WriteConsoleW GetNumberOfConsoleInputEvents WideCharToMultiByte SetConsoleCursorPosition CreateEventA CreateDirectoryW ReadFile GetFileInformationByHandleEx FindFirstFileW GetFileSizeEx SetLastError FindNextFileW WriteFile GetDiskFreeSpaceW RemoveDirectoryW GetFinalPathNameByHandleW SetFileTime ReOpenFile CreateHardLinkW FindClose GetFileAttributesW UnmapViewOfFile GetFileInformationByHandle FlushViewOfFile GetSystemInfo SetFilePointerEx CreateFileMappingA MoveFileExW CopyFileW CreateSymbolicLinkW SetStdHandle MapViewOfFile FlushFileBuffers GetLongPathNameW GetShortPathNameW GetCurrentDirectoryW ReadDirectoryChangesW CreateIoCompletionPort VerifyVersionInfoA EnterCriticalSection SetEnvironmentVariableW LeaveCriticalSection InitializeCriticalSection GetVersionExW FreeEnvironmentStringsW FileTimeToSystemTime QueryPerformanceFrequency VerSetConditionMask GetCurrentProcessId GlobalMemoryStatusEx QueryPerformanceCounter GetEnvironmentStringsW SetConsoleCtrlHandler CancelIo SetHandleInformation RtlUnwind FreeLibrary FormatMessageA LoadLibraryExW SetErrorMode GetQueuedCompletionStatus GetQueuedCompletionStatusEx SetNamedPipeHandleState CreateNamedPipeW PeekNamedPipe CancelSynchronousIo GetNamedPipeHandleStateA CancelIoEx SwitchToThread DeleteCriticalSection ConnectNamedPipe TerminateProcess UnregisterWaitEx LCMapStringW GetExitCodeProcess SleepConditionVariableCS TryEnterCriticalSection TlsSetValue ReleaseSemaphore WakeConditionVariable InitializeConditionVariable ResumeThread TlsAlloc GetNativeSystemInfo TlsGetValue TlsFree CreateSemaphoreA GetModuleHandleA LoadLibraryA DebugBreak GetStartupInfoW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask RtlUnwindEx LoadLibraryW QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList FreeLibraryAndExitThread GetThreadTimes GetConsoleCP GetFileAttributesExW SetFileAttributesW ExitProcess GetDriveTypeW SystemTimeToTzSpecificLocalTime HeapReAlloc HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation HeapSize GetFullPathNameW SetEndOfFile FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetProcessHeap GetSystemTimeAsFileTime SetFileCompletionNotificationModes WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionAndSpinCount CreateEventW GetTickCount EncodePointer DecodePointer GetCPInfo CompareStringW GetLocaleInfoW GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead CreateTimerQueue SignalObjectAndWait CreateThread GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber

user32

MapVirtualKeyW DispatchMessageA GetMessageA ShowWindow GetSystemMetrics TranslateMessage

shell32

SHGetSpecialFolderPathA

advapi32

CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW QueryServiceConfigA DeleteService ControlService StartServiceW OpenServiceW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken LsaOpenPolicy LsaAddAccountRights LsaClose GetTokenInformation

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

303KB

Virtual Size

303KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

264KB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_TEXT_CN

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-10_e1ca17d6b6e82aad0087ba16e9e26ce3_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc_vidar_xmrig

ws2_32

psapi

iphlpapi

kernel32

user32

shell32

advapi32

generic