2026-07-06_30569ee01601ad1c0a1b97f22bd109a3_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_30569ee01601ad1c0a1b97f22bd109a3_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc
Size 15.2MB
Sample260707-e7gsvaez4l
SHA256 b130367076c98c9d12e8a2f2d6508d3c17ef19f282be58ee801e31ffc9734ec3
MD5 30569ee01601ad1c0a1b97f22bd109a3
SHA1 4dab9de5948027b39b20f7be8ab45cf6c9cec771
SHA512 64a80a070c8d975fddf62fe1a911c1c81a9d281c3b897a687b1c464f827b1c838ed9629efc9bcd0b8f5a041c4cc9793535130bbb3e415bc408cae592195e6752
SSDEEP 196608:JuDhJ/BwxTamMSodiaG/CxsEyWoc8ztk7zHSVjah8bmJet/E:MXpwxTamMCYxsWoc8ztO8c8b4exE
TLSH
T194F67C2A62D401E8D0F6C278CA926507E7B1B8191372A3DF369C96651F676E1CE3FF01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-06_30569ee01601ad1c0a1b97f22bd109a3_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc

File Explorer

2026-07-06_30569ee01601ad1c0a1b97f22bd109a3_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc

.exe 15.2MB

2026-07-06_30569ee01601ad1c0a1b97f22bd109a3_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc

IMPHASH 837a01eb7e2f8b3f6ac5b16785bffd9b
SHA256 b130367076c98c9d12e8a2f2d6508d3c17ef19f282be58ee801e31ffc9734ec3
MD5 30569ee01601ad1c0a1b97f22bd109a3
SHA1 4dab9de5948027b39b20f7be8ab45cf6c9cec771
SHA512 64a80a070c8d975fddf62fe1a911c1c81a9d281c3b897a687b1c464f827b1c838ed9629efc9bcd0b8f5a041c4cc9793535130bbb3e415bc408cae592195e6752
SSDEEP 196608:JuDhJ/BwxTamMSodiaG/CxsEyWoc8ztk7zHSVjah8bmJet/E:MXpwxTamMCYxsWoc8ztO8c8b4exE
TLSH
T194F67C2A62D401E8D0F6C278CA926507E7B1B8191372A3DF369C96651F676E1CE3FF01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

48:1d:97:31:8c:4f:f4:e8:0c:bd:35:ca:7f:fa:bb:fc:58:ec:95:51:58:1d:d9:8c:1a:e0:b6:24:14:c0:f2:04

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=CHE-278.733.710,CN=Plesk International GmbH,O=Plesk International GmbH,ST=Schaffhausen,C=CH,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024348

Chains

Apr 30, 2026

SERIALNUMBER=CHE-278.733.710,CN=Plesk International GmbH,O=Plesk International GmbH,ST=Schaffhausen,C=CH,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024348

Subject

SERIALNUMBER=CHE-278.733.710,CN=Plesk International GmbH,O=Plesk International GmbH,ST=Schaffhausen,C=CH,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024348

Serial Number

fc:99:7f:37:45:aa:8c:f5:c4:d7:40:85:28:98:dd:35

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 2, 2023 - Oct 1, 2026

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

13764

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Jenkins\workspace\r_autoinstaller-win-conan_master\autoinstaller\build\msvc\RelWithDebInfo\ai.pdb

kernel32

ReadFile SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetConsoleCtrlHandler GetProcessHeap LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree SystemTimeToTzSpecificLocalTime GetDriveTypeW FormatMessageA FormatMessageW LocalFree CreateEventA LCMapStringA GetStringTypeExA LoadLibraryA SetEvent WaitForSingleObjectEx Sleep GetTickCount CreateDirectoryW DeleteFileW FindFirstFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW OpenMutexW CopyFileW MoveFileW MoveFileExW OutputDebugStringA ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceFrequency WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockShared AcquireSRWLockShared GetTickCount64 InitializeCriticalSectionEx GetLocaleInfoEx DecodePointer LCMapStringEx FlsSetValue CompareStringEx ResetEvent ReleaseSemaphore WaitForMultipleObjectsEx OpenEventA SetWaitableTimer ResumeThread GetSystemInfo GetModuleHandleA CreateWaitableTimerA GetFileInformationByHandle GetEnvironmentVariableW GetCurrentDirectoryW GetFileTime GetFullPathNameW SetEndOfFile DeviceIoControl AreFileApisANSI RtlUnwind CreateThread ExitThread FreeLibraryAndExitThread WaitForSingleObject GetExitCodeProcess CreateProcessW GetTimeZoneInformation GetFileAttributesExW SetConsoleMode ReadConsoleInputW DuplicateHandle CreatePipe CreateFileW GetVersionExA GetModuleFileNameA FreeConsole GetConsoleTitleA SleepEx InitializeConditionVariable CreateFileA MoveFileExA GetEnvironmentVariableA VerSetConditionMask VerifyVersionInfoW PeekNamedPipe WaitForMultipleObjects SleepConditionVariableCS GetLongPathNameW GetSystemDirectoryW SetFilePointer ReleaseMutex CreateMutexW CreateEventW InitializeSRWLock VirtualFree GetSystemDirectoryA SwitchToFiber DeleteFiber CreateFiberEx LoadLibraryW ReadConsoleA ConvertFiberToThread ConvertThreadToFiberEx GetSystemTime SystemTimeToFileTime SetHandleInformation GetConsoleScreenBufferInfo Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection FlsGetValue FlsAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapFree HeapAlloc GetCurrentThread GetCommandLineW GetCommandLineA GetModuleHandleExW TerminateProcess ExitProcess GetCurrentProcess GetModuleFileNameW WriteFile GetStdHandle RtlPcToFileHeader RaiseException EncodePointer LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetDefaultDllDirectories InitializeCriticalSection FileTimeToSystemTime LocalAlloc ReadConsoleW CloseHandle CreateProcessA WriteConsoleW SetLastError GetLastError InterlockedPushEntrySList RtlUnwindEx GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter

shlwapi

PathCanonicalizeW PathCombineW PathFindFileNameW PathFindExtensionW PathRemoveExtensionW PathRemoveFileSpecW PathIsRelativeW PathStripToRootW

msi

ord111 ord141 ord205 ord137 ord45 ord190 ord88 ord70

netapi32

NetUserModalsGet NetUserGetLocalGroups NetApiBufferFree

winmm

timeGetTime

ws2_32

WSAResetEvent ntohs WSAGetLastError ioctlsocket WSAStartup setsockopt send select recv ntohl listen inet_ntoa htons htonl getsockname getsockopt connect closesocket bind accept __WSAFDIsSet socket WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent shutdown WSAWaitForMultipleEvents WSACleanup WSASetLastError WSAIoctl getaddrinfo freeaddrinfo recvfrom sendto getpeername inet_ntop getservbyname getservbyport gethostbyaddr inet_addr gethostbyname gethostname

user32

FindWindowA GetCursorPos TrackPopupMenu AppendMenuA LoadIconA CreatePopupMenu ShowWindow RegisterClassA DefWindowProcA DispatchMessageA GetProcessWindowStation DestroyMenu TranslateMessage GetMessageA LoadStringA MessageBoxW GetUserObjectInformationW CreateWindowExA

advapi32

EqualSid RegOpenKeyExW RegQueryValueExW RegSetValueExW RegGetValueW FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetEntriesInAclW CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA SetServiceStatus RegisterServiceCtrlHandlerA OpenServiceA OpenSCManagerA DeleteService CreateServiceA ChangeServiceConfig2A ConvertSidToStringSidW LogonUserW LookupAccountSidW IsValidSid GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidLengthRequired GetLengthSid CopySid AllocateAndInitializeSid OpenThreadToken OpenProcessToken StartServiceW QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW EnumDependentServicesW ControlService CloseServiceHandle CloseEventLog AddAce AdjustTokenPrivileges DeleteAce GetAce GetAclInformation InitializeAcl LookupPrivilegeValueW SetNamedSecurityInfoW SetFileSecurityW GetNamedSecurityInfoW RegCloseKey RegCreateKeyExW RegEnumKeyExW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW ShellExecuteW Shell_NotifyIconA

rpcrt4

UuidToStringW UuidCreateSequential RpcStringFreeW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wldap32

ord46 ord143 ord211 ord60 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord45 ord50 ord41 ord217

crypt32

CertCloseStore CertGetCertificateContextProperty CertDuplicateCertificateContext CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertFreeCTLContext CertAddCertificateContextToStore CertFreeCRLContext CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore

secur32

InitSecurityInterfaceA

iphlpapi

if_nametoindex

bcrypt

BCryptGenRandom

oleaut32

SysStringLen SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_30569ee01601ad1c0a1b97f22bd109a3_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc

PE Signature issue

kernel32

shlwapi

msi

netapi32

winmm

ws2_32

user32

advapi32

shell32

rpcrt4

version

wldap32

crypt32

secur32

iphlpapi

bcrypt

oleaut32

generic