2026-05-22_8568182399486684b4242603b7a8ae75_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-22_8568182399486684b4242603b7a8ae75_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 7.7MB
Sample260522-d2aa5sdv2n
SHA256 17a684ca39034fb6c5d5a80176b88a126ffdac81da4bce7e54e31661300463a1
MD5 8568182399486684b4242603b7a8ae75
SHA1 6e25b63da7463179b8b987cd2c29ad93a918a2a5
SHA512 54b07ff91cb6056976544f511e3fbf0bd031c802d89a0e50ece88eb29ea4203bf1af97072e2a0c9fdfc04c599509984471990aa1ab80b31ef3d43ff976727189
SSDEEP 98304:ixy7efPrvzn9PVyfr6QL/uNGmBsjL+m+uOzUE2:ixAenr7n9PVyfr6dNrsjLuzw
TLSH
T1EB86AEA9F6BC01D5D87595BCC2965227E332B01417B087DB2AA805F90F63BD4AF7BB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-22_8568182399486684b4242603b7a8ae75_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-05-22_8568182399486684b4242603b7a8ae75_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 7.7MB

2026-05-22_8568182399486684b4242603b7a8ae75_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 177f6993df36c58073d0e456dfe4bb2a
SHA256 17a684ca39034fb6c5d5a80176b88a126ffdac81da4bce7e54e31661300463a1
MD5 8568182399486684b4242603b7a8ae75
SHA1 6e25b63da7463179b8b987cd2c29ad93a918a2a5
SHA512 54b07ff91cb6056976544f511e3fbf0bd031c802d89a0e50ece88eb29ea4203bf1af97072e2a0c9fdfc04c599509984471990aa1ab80b31ef3d43ff976727189
SSDEEP 98304:ixy7efPrvzn9PVyfr6QL/uNGmBsjL+m+uOzUE2:ixAenr7n9PVyfr6dNrsjLuzw
TLSH
T1EB86AEA9F6BC01D5D87595BCC2965227E332B01417B087DB2AA805F90F63BD4AF7BB01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4888760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

RtlUnwind NtQuerySystemInformation RtlAdjustPrivilege RtlVirtualUnwind RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx

dbghelp

SymLoadModuleEx SymGetTypeInfo SymUnloadModule64 SymFromName SymGetSearchPath SymSetSearchPath SymSrvGetFileIndexInfo SymCleanup SymSetOptions SymGetOptions SymInitialize SymGetTypeFromName

bcrypt

BCryptEncrypt BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey

crypt32

CertFindCertificateInStore CertGetCertificateContextProperty CertOpenStore CertDuplicateCertificateContext CryptBinaryToStringA CryptStringToBinaryA CertFreeCertificateContext CertOpenSystemStoreW CertEnumCertificatesInStore CertCloseStore CryptUnprotectData CryptProtectData

iphlpapi

GetAdaptersAddresses

ole32

CoCreateInstance CoUninitialize CoSetProxyBlanket CoInitializeEx CoCreateGuid CreateStreamOnHGlobal

oleaut32

SysAllocString VariantInit SysFreeString SysStringByteLen SysAllocStringByteLen VariantClear

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

gdiplus

GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipSaveImageToStream GdipAlloc GdipCloneImage GdiplusStartup GdipFree GdipDisposeImage GdiplusShutdown GdipGetImageEncoders

kernel32

HeapFree HeapAlloc GetModuleFileNameW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW SetConsoleCtrlHandler ReadFile FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW InitializeCriticalSectionAndSpinCount InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo GetModuleFileNameA FindFirstFileA FindNextFileA FindClose GetCommandLineA MoveFileExA DeleteFileA GetCurrentProcess TerminateProcess CloseHandle GetModuleHandleW GetModuleHandleA LoadLibraryW GetProcAddress FreeLibrary CreateDirectoryW GetEnvironmentVariableW OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW GetSystemDirectoryA Process32FirstW CreateProcessW WideCharToMultiByte GetLogicalDrives MoveFileA WaitForSingleObject GetSystemDirectoryW GetFileAttributesA SetFileAttributesA GetExitCodeProcess GetCurrentThread QueryPerformanceFrequency GetThreadContext QueryPerformanceCounter IsDebuggerPresent CheckRemoteDebuggerPresent GetTickCount64 RaiseFailFastException ExitProcess LocalFree SetStdHandle GetNativeSystemInfo GetComputerNameW GlobalMemoryStatusEx CreateProcessA VirtualFree VirtualAlloc VirtualLock GetEnvironmentVariableA Thread32Next Thread32First HeapReAlloc FlsGetValue CreateFileW SetFileAttributesW MultiByteToWideChar CreateFileA DeleteFileW MoveFileExW CompareStringEx DecodePointer EncodePointer LCMapStringEx InitializeCriticalSectionEx GetLocaleInfoEx GetFileInformationByHandleEx AreFileApisANSI FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW GetTimeZoneInformation IsValidCodePage GetOEMCP GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW SetFilePointerEx GetCurrentDirectoryW SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive InitOnceBeginInitialize InitOnceComplete CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RaiseException WaitForSingleObjectEx FindNextFileW FindFirstFileW ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertThreadToFiberEx ConvertFiberToThread GetSystemTimeAsFileTime GetCurrentProcessId SystemTimeToFileTime GetSystemTime CreateFiberEx FlushFileBuffers IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlsAlloc WriteFile LoadLibraryA GetConsoleOutputCP DeleteFiber SwitchToFiber CreateSemaphoreA GetExitCodeThread ReleaseSemaphore DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetEndOfFile HeapSize GetFileSizeEx CreateDirectoryA WriteConsoleW GetACP VirtualProtect GetModuleHandleExW GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetLocaleInfoA SetLastError GetStdHandle GetFileType FormatMessageA InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

GetUserObjectInformationW GetProcessWindowStation GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard LoadCursorA ClientToScreen GetCursorPos SetCursor SetCursorPos GetCapture GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture OpenClipboard MessageBoxA UpdateWindow PostQuitMessage GetClientRect TranslateMessage PeekMessageW DispatchMessageW ShowWindow RegisterClassExW UnregisterClassW GetSystemMetrics MessageBoxW GetKeyState ScreenToClient GetAsyncKeyState EnumDisplayMonitors GetMonitorInfoA GetWindowTextA EnumWindows DefWindowProcW PostMessageW DestroyWindow CreateWindowExW

gdi32

CreateDCA DeleteObject DeleteDC CreateCompatibleDC SelectObject BitBlt CreateCompatibleBitmap

advapi32

CryptAcquireContextW RegSetValueExA CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext RegOpenKeyExA ReportEventW RegisterEventSourceW DeregisterEventSource RegCreateKeyExA RegQueryValueExA GetUserNameW RegSetValueExW RegOpenKeyExW RegCloseKey

shell32

ShellExecuteA SHGetFolderPathA ShellExecuteW

ws2_32

WSAStartup getaddrinfo inet_pton WSASocketW shutdown closesocket WSACleanup WSASetLastError accept bind getpeername getsockname send socket ntohs connect recv WSAPoll freeaddrinfo ioctlsocket getnameinfo setsockopt WSAGetLastError listen htonl htons inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport getservbyname select recvfrom sendto WSASocketA getsockopt

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

65KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

199KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_8568182399486684b4242603b7a8ae75_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

d3d11

ntdll

dbghelp

bcrypt

crypt32

iphlpapi

ole32

oleaut32

winhttp

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ws2_32

imm32

d3dcompiler_47

generic