2026-07-11_fe6a34e9dae20e6d183c86b9f1187042_coinminer_glassworm_polyvice

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_fe6a34e9dae20e6d183c86b9f1187042_coinminer_glassworm_polyvice
Size 2.7MB
Sample260711-eksltsa18p
SHA256 96dfa5b0e07ce0e8e6286f94269bbb2538cd7b5f9ee6e8c3fd22ea70b522b2f7
MD5 fe6a34e9dae20e6d183c86b9f1187042
SHA1 3b506829c8f34ed6f59e9ceff324a59790d2b28c
SHA512 40ec3f23c795e8cb8a8a75c6ce4c216f62e2f52d2ac0f95191db9028f580fc2d55a12028f1bd6fa50b7975b03cfbe51fb22047f5671d765a859d5300d37f4385
SSDEEP 49152:yQ1Gdo1mShCOGtlqtuIzhVwAsO6e7cC7Bra9TJf0IccIU6iDJtOf03Zt+7hC7y2d:LkeL7B29U+9L3ZtuhC7y23lX
TLSH
T160D57D62F29258DCDE6B8234C6AB9333B734B8A457B1EF671214DA302D13ED02F59B54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_fe6a34e9dae20e6d183c86b9f1187042_coinminer_glassworm_polyvice

File Explorer

2026-07-11_fe6a34e9dae20e6d183c86b9f1187042_coinminer_glassworm_polyvice

.exe 2.7MB

2026-07-11_fe6a34e9dae20e6d183c86b9f1187042_coinminer_glassworm_polyvice

IMPHASH 832667723f2320a749e564c4e6a9de77
SHA256 96dfa5b0e07ce0e8e6286f94269bbb2538cd7b5f9ee6e8c3fd22ea70b522b2f7
MD5 fe6a34e9dae20e6d183c86b9f1187042
SHA1 3b506829c8f34ed6f59e9ceff324a59790d2b28c
SHA512 40ec3f23c795e8cb8a8a75c6ce4c216f62e2f52d2ac0f95191db9028f580fc2d55a12028f1bd6fa50b7975b03cfbe51fb22047f5671d765a859d5300d37f4385
SSDEEP 49152:yQ1Gdo1mShCOGtlqtuIzhVwAsO6e7cC7Bra9TJf0IccIU6iDJtOf03Zt+7hC7y2d:LkeL7B29U+9L3ZtuhC7y23lX
TLSH
T160D57D62F29258DCDE6B8234C6AB9333B734B8A457B1EF671214DA302D13ED02F59B54
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptAcquireContextW CryptGenRandom CryptReleaseContext DeregisterEventSource RegisterEventSourceW ReportEventW

kernel32

CloseHandle ConvertFiberToThread ConvertThreadToFiber CreateFiber CreateThread DeleteCriticalSection DeleteFiber EnterCriticalSection FindClose FindFirstFileW FindNextFileW FormatMessageW FreeLibrary GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetFileType GetLastError GetModuleHandleExW GetModuleHandleW GetProcAddress GetStartupInfoA GetStdHandle GetSystemTimeAsFileTime GetTickCount GetVersion InitializeCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection LoadLibraryA LoadLibraryW MultiByteToWideChar QueryPerformanceCounter ReadConsoleA ReadConsoleW RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleMode SetLastError SetUnhandledExceptionFilter Sleep SwitchToFiber TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _exit _fileno _fmode _gmtime64 _initterm _onexit _setmode _stat64 _strdup _strdup _stricmp _strnicmp _time64 _vsnprintf _vsnwprintf _wfopen abort atoi calloc exit fclose feof ferror fflush fgets fopen fprintf fputc fputs fread free fseek ftell fwrite getenv isprint isspace malloc memchr memcmp memcpy memmove memset qsort raise realloc signal sprintf sscanf strcat strchr strcmp strcpy strcspn strerror strlen strncmp strncpy strrchr strspn strstr strtol strtoul vfprintf wcscpy wcsstr

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

ws2_32

WSACleanup WSAGetLastError WSASetLastError WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname getnameinfo getsockname getsockopt ioctlsocket listen ntohs recv send setsockopt socket

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

453KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

512B

Virtual Size

329B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

155B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_fe6a34e9dae20e6d183c86b9f1187042_coinminer_glassworm_polyvice

advapi32

kernel32

msvcrt

user32

ws2_32

generic