Hostile ^92% Download

2026-09-30_c75a4fbd225c1b93f3ba452e10497eb2_glassworm_icedid_imuler_njrat_poison-ivy_stealc_vidar_xmrig

XMRig cryptominer with evasion

Detects Monero Crypto Coin MinerDetects Windows.Cryptominer.Generic

SHA-2569833a3b5902841097f82869883f56c31438a16aba130b392ce25b31b12a2742e

URLhttps://tria.ge/api/v0/samples/261001-g2lwqayy7r/sample

MaleculeK(Am)O₇(IAlAs₄CDyEr₃P)H₉(Cm₆Cr₃Db₃F₄Hf₂Mg₃Os₉Po₁₁Ti)Md₃(Bi₁₀Si)Th₂

Evidence

XMRig donation-level configuration field 0x12a4ed–0x12a68d

⋯7 more rows
0x12a55d6c6974652f30223a2066616c73650a20lite/0": false. 
0x12a56d2020207d2c0a2020202022646f6e6174   },.    "donat
0x12a57d652d6c6576656c223a20302c0a202020e-level": 0,.   
0x12a58d2022646f6e6174652d6f7665722d7072 "donate-over-pr
0x12a59d6f7879223a20312c0a20202020226c6foxy": 1,.    "lo
0x12a5ad672d66696c65223a206e756c6c2c0a20g-file": null,. 
0x12a5bd20202022706f6f6c73223a205b0a2020   "pools": [.  
0x12a5cd2020202020207b0a2020202020202020      {.        
0x12a5dd2020202022616c676f223a2022636e2f    "algo": "cn/
0x12a5ed72222c0a202020202020202020202020r",.            
0x12a5fd2275726c223a2022332e3132302e3230"url": "3.120.20
0x12a60d392e35383a38303830222c0a202020209.58:8080",.    
0x12a61d20202020202020202275736572223a20        "user": 
⋯7 more rows

Stratum TLS endpoint reference 0x12b5e8–0x12b718

⋯3 more rows
0x12b618c8c1124001000000bcbe124001000000...@.......@....
0x12b6287374726174756d2b7463703a2f2f0000stratum+tcp://..
0x12b638a4b7124001000000b0c1124001000000...@.......@....
0x12b64878c1124001000000a0c1124001000000x..@.......@....
0x12b6587374726174756d2b73736c3a2f2f0000stratum+ssl://..
0x12b66898c1124001000000e4be124001000000...@.......@....
⋯11 more rows

XMRig miner reference 0x12c612–0x12c732

⋯5 more rows
0x12c662676f00000000646f6e6174652e76322ego....donate.v2.
0x12c672786d7269672e636f6d00616c676f0000xmrig.com.algo..
0x12c68200000000000068d21240010000001b5b......h..@.....[
⋯11 more rows

Windows System32 directory reference 0x12c911–0x12cac1

⋯7 more rows
0x12c9815353454d424c59000000000000000020SSEMBLY........ 
0x12c9912a20434f4d4d414e4453202020202027* COMMANDS     '
0x12c9a168272068617368726174652c20277027h' hashrate, 'p'
0x12c9b12070617573652c202772272072657375 pause, 'r' resu
0x12c9c16d6500000000007300660064006b006ame.....s.f.d.k.j
0x12c9d1006a00680067006b0064007300660068.j.h.g.k.d.s.f.h
⋯4 more rows
0x12ca2158595a00000000257325732e65786500XYZ....%s%s.exe.
0x12ca3100000000000000433a5c57696e646f77.......C:\Window
0x12ca41735c53797374656d33325c000000006es\System32\....n
0x12ca5100740064006c006c002e0064006c006c.t.d.l.l...d.l.l
⋯7 more rows

Detects Windows.Cryptominer.Generic 0x156416–0x156596

⋯7 more rows
0x15648609488bc4535556574154415541564157.H..SUVWATAUAVAW
0x1564964881ecb80000000fae9c2410010000c7H.........$.....
0x1564a6842414010000805f00000fae94241401.$....._.....$..
⋯15 more rows