2026-07-11_17557e04bc51d96f26597469a5083126_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_17557e04bc51d96f26597469a5083126_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 7.6MB
Sample260711-fg9llses21
SHA256 dd2f960c856c42404d48c7ac083d5ee3242b4069186778737604865162638049
MD5 17557e04bc51d96f26597469a5083126
SHA1 cf3598780a31c9fd648a25ececd2e6dc71586f53
SHA512 85b3f9681b6934c2997a74bc51eadfba5830315ba215342142791430acb66fc79ac5717b8796b9566e0bf148517be4274f3201b6d4f371d0c92e3f8decfeb88a
SSDEEP 49152:gLGtlqrVwASOrb0RxzZ9k25L9thw4D0fRv5AlM+LpB2QBTKV7rZlbgP828XdAqL8:43fgEtQe14utvc6I14W619B+xZwXKj
TLSH
T126868D6AA6BC42D9D47EC1B8C68AA533E771B41513B057CF1A6046F61F23BE01E7EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_17557e04bc51d96f26597469a5083126_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-11_17557e04bc51d96f26597469a5083126_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 7.6MB

2026-07-11_17557e04bc51d96f26597469a5083126_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH c38bc880692514144e2a31f7f567d9e8
SHA256 dd2f960c856c42404d48c7ac083d5ee3242b4069186778737604865162638049
MD5 17557e04bc51d96f26597469a5083126
SHA1 cf3598780a31c9fd648a25ececd2e6dc71586f53
SHA512 85b3f9681b6934c2997a74bc51eadfba5830315ba215342142791430acb66fc79ac5717b8796b9566e0bf148517be4274f3201b6d4f371d0c92e3f8decfeb88a
SSDEEP 49152:gLGtlqrVwASOrb0RxzZ9k25L9thw4D0fRv5AlM+LpB2QBTKV7rZlbgP828XdAqL8:43fgEtQe14utvc6I14W619B+xZwXKj
TLSH
T126868D6AA6BC42D9D47EC1B8C68AA533E771B41513B057CF1A6046F61F23BE01E7EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5358108

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSAGetLastError WSACleanup sendto setsockopt ioctlsocket getservbyname getservbyport gethostbyname gethostbyaddr inet_ntoa recvfrom WSASetLastError WSASocketA recv getnameinfo send socket WSAStartup inet_addr __WSAFDIsSet accept WSAIoctl getsockname connect getaddrinfo freeaddrinfo select bind listen WSASocketW htons closesocket WSASend ntohl shutdown getpeername ntohs WSARecv getsockopt htonl

advapi32

CryptReleaseContext LookupPrivilegeValueA AdjustTokenPrivileges InitializeSecurityDescriptor SetSecurityDescriptorDacl DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptGenRandom OpenProcessToken

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertOpenSystemStoreW

user32

GetSystemMetrics GetProcessWindowStation GetUserObjectInformationW MessageBoxW

iphlpapi

GetIpAddrTable GetBestRoute

kernel32

FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA GetModuleFileNameW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW ExitProcess GetTimeZoneInformation FreeLibraryAndExitThread CompareStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP SetStdHandle HeapReAlloc IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize HeapQueryInformation GetProcessHeap ExitThread LoadLibraryExW RtlUnwindEx GetDateFormatW LCMapStringW GetTimeFormatW EnterCriticalSection LeaveCriticalSection PostQueuedCompletionStatus FormatMessageW LocalFree WideCharToMultiByte FormatMessageA GetSystemTimeAsFileTime VirtualFree VirtualAlloc GetCurrentProcess GetLastError CloseHandle CancelIoEx SetWaitableTimer SetLastError WaitForMultipleObjects InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus WaitForSingleObject GetModuleHandleA CreateEventW SetEvent TerminateThread QueueUserAPC GetProcAddress DeleteCriticalSection SleepEx CreateIoCompletionPort CreateWaitableTimerA Sleep GetVersionExA SetConsoleCtrlHandler GetStdHandle SetConsoleTextAttribute GetEnvironmentVariableW GetCurrentDirectoryW CreateDirectoryW CreateFileW FlushFileBuffers GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetEndOfFile SetFilePointerEx DeviceIoControl GetModuleHandleW MoveFileExW AreFileApisANSI MultiByteToWideChar GetFileSize GetFileSizeEx LockFile LockFileEx ReadFile SetFilePointer UnlockFile WriteFile GetOverlappedResult ReleaseMutex CreateMutexA CreateEventA SignalObjectAndWait GetCurrentProcessId CreateThread GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree OpenProcess GetVersion RtlUnwind FlushViewOfFile UnmapViewOfFile OpenMutexA CreateFileMappingA GetFileType VirtualProtect SwitchToFiber DeleteFiber CreateFiber GetSystemDirectoryA FreeLibrary LoadLibraryA GetSystemTime SystemTimeToFileTime FindClose FindFirstFileW FindNextFileW GetModuleHandleExW InitializeCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetACP ConvertFiberToThread ConvertThreadToFiber TerminateProcess RtlVirtualUnwind LoadLibraryW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeSListHead GetStartupInfoW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx WriteConsoleW GetSystemInfo MapViewOfFileEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency RtlPcToFileHeader RaiseException WaitForSingleObjectEx SwitchToThread IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW GetTickCount64 WakeConditionVariable WakeAllConditionVariable GetLocaleInfoEx FindFirstFileExW SetFileInformationByHandle GetFileInformationByHandleEx GetStringTypeW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx

shell32

SHGetSpecialFolderPathA

mswsock

AcceptEx GetAcceptExSockaddrs

bcrypt

BCryptGenRandom BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

dnsapi

DnsQuery_A DnsFree

??0?$codecvt_null@_W@archive@boost@@QEAA@_K@Z ??1?$codecvt_null@_W@archive@boost@@UEAA@XZ ??_F?$codecvt_null@_W@archive@boost@@QEAAXXZ ?do_always_noconv@?$codecvt_null@_W@archive@boost@@EEBA_NXZ ?do_encoding@?$codecvt_null@_W@archive@boost@@EEBAHXZ ?do_in@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?do_max_length@?$codecvt_null@_W@archive@boost@@EEBAHXZ ?do_out@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?get_const_instance@?$singleton@V?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vxml_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@QEAA_NXZ ?lock@?1??get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@QEAAXXZ ?unlock@singleton_module@serialization@boost@@QEAAXXZ

Name

.text

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

87KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

223KB

Virtual Size

222KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_17557e04bc51d96f26597469a5083126_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

ws2_32

advapi32

crypt32

user32

iphlpapi

kernel32

shell32

mswsock

bcrypt

dnsapi

generic