2026-07-06_5dbf81e81dc80eab2a33adfa461206ba_coinminer_glassworm_icedid_njrat_remcos_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_5dbf81e81dc80eab2a33adfa461206ba_coinminer_glassworm_icedid_njrat_remcos_ryuk
Size 13.8MB
Sample260707-d3xstsd17n
SHA256 c4eb12b198f400e99d22c22ad5addbb685f2ee96f8e22fed500cbfa45eb05900
MD5 5dbf81e81dc80eab2a33adfa461206ba
SHA1 e48109392146946f70a43d1fe9f15922fb941b21
SHA512 b2ef4fb8c66155b9c3534ff3d08ed57744fa711d9c0dc53089902b5e5afe3844574b78296577b6be0c0ac2cfd1747966b9603a708c3318e5f0629cc9e753c135
SSDEEP 98304:84+Izqt5GNeo37vAP0ulyxnTgiEDcBLhmuvlOVzouOuUtEVj6ia:84+IG74rvAP8TgiEctOVBJ+b
TLSH
T1A1E67C1D36544090C0E3C178C753A6A3EBB074599B3397F7718D992D1FB3AE18A7AE22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-07-06_5dbf81e81dc80eab2a33adfa461206ba_coinminer_glassworm_icedid_njrat_remcos_ryuk

File Explorer

2026-07-06_5dbf81e81dc80eab2a33adfa461206ba_coinminer_glassworm_icedid_njrat_remcos_ryuk

.exe 13.8MB

2026-07-06_5dbf81e81dc80eab2a33adfa461206ba_coinminer_glassworm_icedid_njrat_remcos_ryuk

IMPHASH ec1559cbe8c4ec40d08cbb9353a5c017
SHA256 c4eb12b198f400e99d22c22ad5addbb685f2ee96f8e22fed500cbfa45eb05900
MD5 5dbf81e81dc80eab2a33adfa461206ba
SHA1 e48109392146946f70a43d1fe9f15922fb941b21
SHA512 b2ef4fb8c66155b9c3534ff3d08ed57744fa711d9c0dc53089902b5e5afe3844574b78296577b6be0c0ac2cfd1747966b9603a708c3318e5f0629cc9e753c135
SSDEEP 98304:84+Izqt5GNeo37vAP0ulyxnTgiEDcBLhmuvlOVzouOuUtEVj6ia:84+IG74rvAP8TgiEctOVBJ+b
TLSH
T1A1E67C1D36544090C0E3C178C753A6A3EBB074599B3397F7718D992D1FB3AE18A7AE22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

a8:aa:05:23:21:23:1f:d7:d1:7d:cc:5b:f2:64:43:6d:16:31:48:0c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Plesk International GmbH,O=Plesk International GmbH,POSTALCODE=8200,STREET=Vordergasse 59,L=Schaffhausen,ST=Schaffhausen,C=CH

Chains

Aug 21, 2018

CN=Plesk International GmbH,O=Plesk International GmbH,POSTALCODE=8200,STREET=Vordergasse 59,L=Schaffhausen,ST=Schaffhausen,C=CH

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Minor OS version

Major OS version

Entry point

62256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

J:\jenkins\workspace\autoinstaller-win-3-23\build\msvc\RelWithDebInfo\ai.pdb

kernel32

SetFilePointerEx WriteConsoleW CreateFileW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindNextFileA FindFirstFileExA FindClose CreateThread WaitForSingleObjectEx CloseHandle OutputDebugStringA GetCurrentThread HeapAlloc HeapFree GetACP GetCommandLineW GetCommandLineA GetModuleHandleExW TerminateProcess ExitProcess GetCurrentProcess WideCharToMultiByte MultiByteToWideChar GetModuleFileNameA SystemTimeToTzSpecificLocalTime GetDriveTypeW GetConsoleTitleA FreeConsole SetHandleInformation GetConsoleScreenBufferInfo Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection InitializeCriticalSection GetSystemTime GetModuleFileNameW CreatePipe CreateEventA SetEvent CreateDirectoryW DeleteFileW GetFileAttributesW GetConsoleMode HeapReAlloc CopyFileW MoveFileW MoveFileExW GetTempFileNameW FindFirstFileW RemoveDirectoryW GetTickCount DecodePointer CreateEventW Sleep ResetEvent OpenEventA GetModuleHandleA GetSystemInfo WaitForMultipleObjectsEx ReleaseSemaphore SetWaitableTimer ResumeThread CreateWaitableTimerA SystemTimeToFileTime ReadFile WaitForSingleObject GetExitCodeProcess CreateProcessA CreateProcessW QueryPerformanceFrequency ReadConsoleInputA SetConsoleMode ExitThread FreeLibraryAndExitThread GetTimeZoneInformation ReadConsoleW GetFileAttributesExW SetEndOfFile GetEnvironmentVariableW GetCurrentDirectoryW GetFileTime GetFullPathNameW SetFileTime DeviceIoControl AreFileApisANSI LoadLibraryA LCMapStringA GetStringTypeExA LoadLibraryW GlobalMemoryStatus FlushConsoleInputBuffer GetTickCount64 InitializeCriticalSectionEx SleepEx VerSetConditionMask GetSystemDirectoryA VerifyVersionInfoA ExpandEnvironmentStringsA PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsW GetLongPathNameW GetTempPathW GetSystemDirectoryW SetFilePointer GetEnvironmentVariableA GetVersionExA ReleaseMutex CreateMutexW DuplicateHandle FileTimeToSystemTime LocalAlloc GetConsoleCP SetFileAttributesW FlushFileBuffers WriteFile HeapSize SetConsoleCtrlHandler GetProcessHeap GetStringTypeW FormatMessageW GetFileType GetStdHandle LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RaiseException EncodePointer RtlPcToFileHeader InterlockedPushEntrySList RtlUnwindEx FormatMessageA LocalFree GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter

shlwapi

PathRemoveFileSpecW PathStripToRootW PathRemoveExtensionW PathCanonicalizeW PathCombineW PathFindFileNameW PathIsRelativeW PathFindExtensionW

msi

ord45 ord205 ord141 ord137 ord88 ord190 ord111 ord70

netapi32

NetApiBufferFree NetValidatePasswordPolicy NetValidatePasswordPolicyFree NetUserModalsGet NetUserGetLocalGroups

normaliz

IdnToAscii

ws2_32

__WSAFDIsSet socket WSAGetLastError select WSAStartup WSASetLastError recv send bind closesocket setsockopt gethostbyname connect getpeername getsockname getsockopt htons ntohs inet_ntoa shutdown ntohl htonl gethostname ioctlsocket sendto recvfrom listen accept freeaddrinfo getaddrinfo WSAIoctl WSACleanup getservbyname

wldap32

ord33 ord32 ord35 ord26 ord22 ord143 ord79 ord30 ord200 ord301 ord27 ord50 ord45 ord60 ord211 ord46 ord41

winmm

timeGetTime

user32

GetUserObjectInformationW GetProcessWindowStation LoadStringA MessageBoxW LoadIconA FindWindowA GetCursorPos TrackPopupMenu AppendMenuA DestroyMenu CreatePopupMenu ShowWindow CreateWindowExA RegisterClassA DefWindowProcA DispatchMessageA TranslateMessage GetMessageA

advapi32

ReportEventW DeregisterEventSource ConvertSidToStringSidW LogonUserW GetSidSubAuthorityCount GetSidLengthRequired CryptReleaseContext CryptGenRandom CryptAcquireContextA StartServiceW QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW EnumDependentServicesW ControlService CloseServiceHandle SetNamedSecurityInfoW GetNamedSecurityInfoW LookupPrivilegeValueW LookupAccountSidW IsValidSid InitializeAcl GetTokenInformation GetSidSubAuthority GetLengthSid GetAclInformation GetAce EqualSid DeleteAce CopySid AllocateAndInitializeSid AdjustTokenPrivileges AddAce OpenThreadToken OpenProcessToken RegisterEventSourceW CloseEventLog SetFileSecurityW RegCloseKey RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW LookupAccountNameW FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetEntriesInAclW ChangeServiceConfig2A CreateServiceA DeleteService OpenSCManagerA OpenServiceA RegisterServiceCtrlHandlerA SetServiceStatus

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate UuidCreateSequential

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

iphlpapi

GetIpAddrTable

shell32

CommandLineToArgvW ShellExecuteW SHGetSpecialFolderPathW Shell_NotifyIconA

oleaut32

SysFreeString SysStringLen

Name

.text

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.0MB

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

340KB

Virtual Size

380KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

216KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=12, id=241, version=40116,

count=203, id=243, version=40116,

count=27, id=242, version=40116,

count=24, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=9, id=199, version=41118,

count=8, id=259, version=24123,

count=72, id=261, version=24123,

count=40, id=260, version=24123,

count=14, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=48, id=261, version=24225,

count=1, id=208, version=65501,

count=431, id=1, productName=Unmarked objects,

count=37, id=203, version=65501,

count=104, id=260, version=24225,

count=494, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=265, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,