2026-04-22_71fd59f5ea2700daf99e55460c91d6f4_coinminer_glassworm_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-22_71fd59f5ea2700daf99e55460c91d6f4_coinminer_glassworm_icedid_mespinoza_njrat_ryuk
Size 1.1MB
Sample260422-sdlftsdv4t
SHA256 ec214486c98d01d231c96ce78f0f0cc10f3361fcbd09de3c944d1e1c635e05dd
MD5 71fd59f5ea2700daf99e55460c91d6f4
SHA1 7b711c23bdf9f15ec93b13d9c2fbfda882c6d443
SHA512 a9eefd270a309c5a7593479c05cf395197282204eec1bb3d85dfdf184007d612e64bd7b8d47bcc1a1b1436de2f34832689b07b8ddd2accd499f2bcdfff60021b
SSDEEP 24576:vc69QImJBnpUny3+ezXnmHBu8j5NSGqJvM6Aw6FAr/1bcWNFbD4zWRkJ:E/36y3+eL5d0Bmz1bcWNFbD4zWRkJ
TLSH
T15B453957E6B611E4D4B6C138C6633627FD7178498334AB978B85971A1F32BA0EA3F700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
2026-04-22_71fd59f5ea2700daf99e55460c91d6f4_coinminer_glassworm_icedid_mespinoza_njrat_ryuk

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-04-22_71fd59f5ea2700daf99e55460c91d6f4_coinminer_glassworm_icedid_mespinoza_njrat_ryuk

File Explorer

2026-04-22_71fd59f5ea2700daf99e55460c91d6f4_coinminer_glassworm_icedid_mespinoza_njrat_ryuk

.exe 1.1MB

2026-04-22_71fd59f5ea2700daf99e55460c91d6f4_coinminer_glassworm_icedid_mespinoza_njrat_ryuk

IMPHASH 8b6204fc0382be3024a3d5185918b48c
SHA256 ec214486c98d01d231c96ce78f0f0cc10f3361fcbd09de3c944d1e1c635e05dd
MD5 71fd59f5ea2700daf99e55460c91d6f4
SHA1 7b711c23bdf9f15ec93b13d9c2fbfda882c6d443
SHA512 a9eefd270a309c5a7593479c05cf395197282204eec1bb3d85dfdf184007d612e64bd7b8d47bcc1a1b1436de2f34832689b07b8ddd2accd499f2bcdfff60021b
SSDEEP 24576:vc69QImJBnpUny3+ezXnmHBu8j5NSGqJvM6Aw6FAr/1bcWNFbD4zWRkJ:E/36y3+eL5d0Bmz1bcWNFbD4zWRkJ
TLSH
T15B453957E6B611E4D4B6C138C6633627FD7178498334AB978B85971A1F32BA0EA3F700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e2:ca:ee:53:8c:24:15:d8:12:23:52:23:73:dc:6b:ab:48:16:c5:8f:77:3a:10:c1:d8:f1:30:64:e5:fc:21:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=POLEMOLOGY LTD.,OU=IT,O=POLEMOLOGY LTD.,L=Aldershot,C=GB

Chains

Sep 24, 2019

CN=POLEMOLOGY LTD.,OU=IT,O=POLEMOLOGY LTD.,L=Aldershot,C=GB

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

90:92:41:2e:bc:a1:9d:8b:b0:cf:3d:8d:da:e7:9b:20:3f:f9:55:d4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=POLEMOLOGY LTD.,OU=IT,O=POLEMOLOGY LTD.,L=Aldershot,C=GB

Chains

Sep 24, 2019

CN=POLEMOLOGY LTD.,OU=IT,O=POLEMOLOGY LTD.,L=Aldershot,C=GB

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=POLEMOLOGY LTD.,OU=IT,O=POLEMOLOGY LTD.,L=Aldershot,C=GB

Serial Number

16:e2:6b:8b:5f:91:59:02:46:a8:dd:d4:7d:60:97:b8

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Mar 1, 2023

Timespan

Jan 30, 2019 - Jan 30, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

57372

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegOpenKeyExA RegEnumKeyExA RegQueryValueExA RegCloseKey OpenProcessToken GetTokenInformation ConvertSidToStringSidA RegGetKeySecurity GetSecurityDescriptorDacl ConvertStringSidToSidA LookupAccountSidA BuildExplicitAccessWithNameA SetEntriesInAclA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegOpenKeyA OpenSCManagerA OpenServiceA CloseServiceHandle QueryServiceObjectSecurity SetServiceObjectSecurity LookupPrivilegeValueA AdjustTokenPrivileges StartServiceCtrlDispatcherA RegOpenKeyExW RegQueryValueExW CryptDestroyKey CryptEncrypt CryptImportKey CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptAcquireContextA CryptGenRandom CryptReleaseContext

ws2_32

__WSAFDIsSet WSACleanup WSAGetLastError gethostname htonl ntohl recv send setsockopt htons getsockopt accept listen recvfrom sendto getaddrinfo freeaddrinfo ioctlsocket WSAStartup select bind WSAIoctl closesocket WSASetLastError getpeername getsockname socket ntohs connect

wldap32

ord26 ord211 ord301 ord22 ord46 ord45 ord35 ord27 ord200 ord79 ord33 ord41 ord32 ord60 ord30 ord50 ord143

normaliz

IdnToAscii

crypt32

CertFreeCertificateContext

wtsapi32

WTSFreeMemory WTSEnumerateSessionsA WTSQueryUserToken

kernel32

GetFullPathNameW GetCurrentDirectoryW GetFileAttributesExW CreateProcessA GetExitCodeProcess SetEndOfFile SetStdHandle FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode GetACP GetCommandLineW GetCommandLineA SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess CreateFileW GetTimeZoneInformation FindFirstFileExA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA LoadLibraryExW RtlUnwindEx RtlPcToFileHeader InitializeSListHead GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW GetLastError HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetTickCount WTSGetActiveConsoleSessionId CloseHandle CreateToolhelp32Snapshot GetCurrentProcessId Process32First Process32Next GetModuleFileNameA GetProcAddress GetModuleHandleA GetCurrentProcess LoadLibraryA FreeLibrary Sleep OpenProcess LocalFree MoveFileExA VirtualAlloc GetThreadContext ReadProcessMemory VirtualAllocEx WriteProcessMemory ResumeThread CreateFileA WriteFile ReadFile GetFileSize lstrcmpiA WaitForSingleObject InitializeCriticalSectionAndSpinCount RaiseException DecodePointer DeleteCriticalSection GetFileAttributesA GetTempPathA DeleteFileA MultiByteToWideChar FindFirstFileA FindNextFileA FindClose TerminateThread FindFirstVolumeW SleepEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx GetTickCount64 VerifyVersionInfoA GetSystemDirectoryA VerSetConditionMask SetLastError FormatMessageA ExpandEnvironmentStringsA GetStdHandle WaitForMultipleObjects PeekNamedPipe GetFileType WaitForSingleObjectEx ResetEvent SetEvent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetModuleHandleW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW EncodePointer OutputDebugStringW IsDebuggerPresent WriteConsoleW

user32

GetWindowThreadProcessId AllowSetForegroundWindow MsgWaitForMultipleObjects DispatchMessageA PeekMessageA

shell32

SHGetSpecialFolderPathW SHGetFolderPathA

ole32

CoCreateInstance CoUninitialize CoInitialize CoTaskMemFree

oleaut32

SysAllocString VariantInit VariantClear SysFreeString

shlwapi

SHGetValueA ord176 SHDeleteKeyA PathRemoveFileSpecA PathRemoveExtensionA PathFileExistsA SHSetValueA PathFindFileNameA

Name

.text

Size

789KB

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

163KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

53KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

528B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-22_71fd59f5ea2700daf99e55460c91d6f4_coinminer_glassworm_icedid_mespinoza_njrat_ryuk

PE Signature issue

PE Signature issue

advapi32

ws2_32

wldap32

normaliz

crypt32

wtsapi32

kernel32

user32

shell32

ole32

oleaut32

shlwapi

generic