2026-06-01_1a5516529dd583f1380e56770d924917_coinminer_glassworm_hijackloader_icedid_njrat_pos_remcos_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-01_1a5516529dd583f1380e56770d924917_coinminer_glassworm_hijackloader_icedid_njrat_pos_remcos_vidar
Size 9.8MB
Sample260601-qs1sysdz6t
SHA256 b22c882a800d34dfa993efb0460da77df35ff8fa4d3ecd868f2b83833de29ee9
MD5 1a5516529dd583f1380e56770d924917
SHA1 336a3feceba89154a91e0a52fdb7d240b5dd7281
SHA512 39faa339f864d79c0159394449e95b7759285858dc3f1e262859815cc40f8fa55ff3f3c1c8bb9e73d379212acc4efa82c180cc07145dd9da277a4c4e2180daf3
SSDEEP 196608:rocWvNbPd1kvtByvgxY/nMNE/dPydQCGVQBWG:rocWlx1GtrxYs5B
TLSH
T115A63A03BBA48D66D5BAF33687531E11B7B2F4486F13D39B11C487AA2D47382AD2531E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects encrypted or obfuscated .NET executables 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_DotNET_Encrypted

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Dotfuscator

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-01_1a5516529dd583f1380e56770d924917_coinminer_glassworm_hijackloader_icedid_njrat_pos_remcos_vidar

File Explorer

2026-06-01_1a5516529dd583f1380e56770d924917_coinminer_glassworm_hijackloader_icedid_njrat_pos_remcos_vidar

.exe 9.8MB

2026-06-01_1a5516529dd583f1380e56770d924917_coinminer_glassworm_hijackloader_icedid_njrat_pos_remcos_vidar

IMPHASH 038af53c09c73a3006e0f8ba31ab22ce
SHA256 b22c882a800d34dfa993efb0460da77df35ff8fa4d3ecd868f2b83833de29ee9
MD5 1a5516529dd583f1380e56770d924917
SHA1 336a3feceba89154a91e0a52fdb7d240b5dd7281
SHA512 39faa339f864d79c0159394449e95b7759285858dc3f1e262859815cc40f8fa55ff3f3c1c8bb9e73d379212acc4efa82c180cc07145dd9da277a4c4e2180daf3
SSDEEP 196608:rocWvNbPd1kvtByvgxY/nMNE/dPydQCGVQBWG:rocWlx1GtrxYs5B
TLSH
T115A63A03BBA48D66D5BAF33687531E11B7B2F4486F13D39B11C487AA2D47382AD2531E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects encrypted or obfuscated .NET executables
Detects executables packed with Dotfuscator
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1523020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\cygwin\home\bat\bat\checkout\zon\build.app_win64r_obf\pkg\win\sdk\net_updater64.exe.pdb

wintrust

WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WinVerifyTrust WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

advapi32

CheckTokenMembership SetEntriesInAclW ReportEventA RegisterEventSourceA DeregisterEventSource CryptGenRandom CryptReleaseContext RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW CreateProcessAsUserW InitializeSecurityDescriptor ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW QueryServiceStatusEx SetServiceObjectSecurity StartServiceW OpenProcessToken AllocateAndInitializeSid SetNamedSecurityInfoW FreeSid SetSecurityDescriptorDacl AdjustTokenPrivileges LookupPrivilegeValueW CryptAcquireContextW

winhttp

WinHttpConnect WinHttpSetStatusCallback WinHttpReceiveResponse WinHttpCloseHandle WinHttpOpen WinHttpSendRequest WinHttpAddRequestHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpQueryHeaders

ws2_32

__WSAFDIsSet WSASetLastError WSAGetLastError WSAIoctl WSAEventSelect WSACleanup WSAStartup socket shutdown setsockopt sendto send select recvfrom recv listen getsockname getpeername ioctlsocket connect closesocket bind accept

kernel32

LCMapStringW CompareStringW GetACP GetCommandLineA RemoveDirectoryW CreateDirectoryW GetCurrentDirectoryW SetEnvironmentVariableW SetEnvironmentVariableA SetFilePointerEx GetConsoleCP DeleteFileW WriteConsoleW GetModuleFileNameA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread ExitThread CreateThread WaitForSingleObject SetStdHandle GetModuleHandleExW ExitProcess LoadLibraryExW GetCommandLineW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW LocalFree SetDllDirectoryW SetSearchPathMode WideCharToMultiByte SetLastError HeapAlloc HeapFree GetProcessHeap GetNativeSystemInfo VirtualAlloc VirtualProtect VirtualFree FreeLibrary GetProcAddress LoadLibraryA IsBadReadPtr RaiseException GetLastError GetSystemInfo VirtualQuery LoadLibraryExA IsDebuggerPresent OutputDebugStringW GetTempPathW CloseHandle SetUnhandledExceptionFilter Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentThread GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext Thread32First Thread32Next Module32FirstW Module32NextW GetEnvironmentStringsW DuplicateHandle WaitForSingleObjectEx CreateProcessW WTSGetActiveConsoleSessionId InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection TerminateThread QueueUserAPC SetConsoleCtrlHandler GetModuleFileNameW GetTickCount GetVersionExW ReadFile ReadFileEx WriteFile WriteFileEx SetHandleInformation ConnectNamedPipe SetNamedPipeHandleState PeekNamedPipe SleepEx SetEndOfFile LoadLibraryW CreateFileW FindClose FindFirstFileW FindNextFileW CreateNamedPipeW CancelIo UnregisterWaitEx RegisterWaitForSingleObject GetModuleHandleExA RtlVirtualUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetStdHandle GetFileType OutputDebugStringA GetModuleHandleA SwitchToFiber DeleteFiber CreateFiber GetSystemTime SystemTimeToFileTime ConvertFiberToThread ConvertThreadToFiber FindFirstFileA FindNextFileA MultiByteToWideChar GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter InitializeSListHead GetTimeZoneInformation GetSystemTimeAdjustment SetFileTime GetFullPathNameW GetFileInformationByHandle GetFileAttributesW GetFileAttributesExW MoveFileExW FormatMessageW GetStringTypeW HeapReAlloc FlushFileBuffers IsValidCodePage GetOEMCP GetCPInfo FreeEnvironmentStringsW FindFirstFileExA HeapSize

userenv

CreateEnvironmentBlock

shell32

SHGetFolderPathW CommandLineToArgvW SHGetKnownFolderPath

wtsapi32

WTSQueryUserToken

ntdll

NtTestAlert NtFsControlFile RtlCaptureContext NtDeviceIoControlFile RtlInitUnicodeString NtCreateSection NtMapViewOfSection NtUnmapViewOfSection RtlLookupFunctionEntry RtlUnwindEx NtCreateFile NtQuerySystemInformation

iphlpapi

GetAdaptersInfo GetExtendedTcpTable GetExtendedUdpTable

psapi

GetModuleInformation GetModuleFileNameExW EnumProcessModules

winmm

timeGetTime timeBeginPeriod timeEndPeriod

user32

MessageBoxA GetUserObjectInformationW GetProcessWindowStation MsgWaitForMultipleObjectsEx

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

762KB

Virtual Size

762KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

87KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6.7MB

Virtual Size

6.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

600KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-01_1a5516529dd583f1380e56770d924917_coinminer_glassworm_hijackloader_icedid_njrat_pos_remcos_vidar

wintrust

crypt32

advapi32

winhttp

ws2_32

kernel32

userenv

shell32

wtsapi32

ntdll

iphlpapi

psapi

winmm

user32

generic