2026-07-12_e0ee6b106032619dd21dfa553d2adf7b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-12_e0ee6b106032619dd21dfa553d2adf7b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 54.7MB
Sample260712-xqf44ahw21
SHA256 58748b5b53e9148f8e135c2001319ab5a61b5cf81096f4e1f66621a7bc06f2d4
MD5 e0ee6b106032619dd21dfa553d2adf7b
SHA1 8a19c39b6552a8dfb9a8d3554beed4b1e93334b6
SHA512 e62d8192af739a7b2946963626612bc7b4503f01e417d1beef7a9197b25afe4222ed14bc6d96a584de328e96844616a4e864ab1e24aaa6fb288f2d6053d08bdd
SSDEEP 1572864:p/5xMIMbfiSVQUSAnr49KsxkYzlYm5uhN:phxMZfiSfEZxj
TLSH
T1AAC701C675E051ECC7D2C034D28A5BEAE2E178654FB6866B7FC508022A32DD2CDB5E35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_e0ee6b106032619dd21dfa553d2adf7b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-12_e0ee6b106032619dd21dfa553d2adf7b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 54.7MB

2026-07-12_e0ee6b106032619dd21dfa553d2adf7b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 1962205e4fcf54c66d78bff942bfd266
SHA256 58748b5b53e9148f8e135c2001319ab5a61b5cf81096f4e1f66621a7bc06f2d4
MD5 e0ee6b106032619dd21dfa553d2adf7b
SHA1 8a19c39b6552a8dfb9a8d3554beed4b1e93334b6
SHA512 e62d8192af739a7b2946963626612bc7b4503f01e417d1beef7a9197b25afe4222ed14bc6d96a584de328e96844616a4e864ab1e24aaa6fb288f2d6053d08bdd
SSDEEP 1572864:p/5xMIMbfiSVQUSAnr49KsxkYzlYm5uhN:phxMZfiSfEZxj
TLSH
T1AAC701C675E051ECC7D2C034D28A5BEAE2E178654FB6866B7FC508022A32DD2CDB5E35
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3490012

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTempPathW ReadFile GetFileSizeEx SetFilePointer CreateWaitableTimerW GlobalLock GlobalUnlock GetConsoleScreenBufferInfo SetConsoleTextAttribute GetCommandLineW GetStdHandle WriteConsoleA WriteFile GetDynamicTimeZoneInformation GetConsoleMode GetTimeZoneInformation SetConsoleCP SetConsoleOutputCP GetTickCount AllocConsole Beep SetHandleInformation DuplicateHandle GetThreadContext SetThreadContext WriteProcessMemory ExpandEnvironmentStringsW GetFileAttributesW OpenProcess SetFileAttributesW GetTickCount64 K32GetModuleFileNameExA K32GetModuleBaseNameW GetSystemInfo K32GetModuleInformation VirtualProtectEx ReadProcessMemory K32EnumProcessModules QueryPerformanceCounter VirtualQueryEx GlobalAlloc GlobalFree GetLocaleInfoA FindClose GetEnvironmentVariableW FindNextFileW FindFirstFileW DeleteFileW VirtualAlloc CreateFileW DeviceIoControl SetEndOfFile WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle CreateProcessW GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP FlushFileBuffers SetFilePointerEx HeapQueryInformation HeapSize HeapReAlloc FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW ExitProcess SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RtlUnwind RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent CreateDirectoryW GetCurrentProcess VirtualFree GetSystemDirectoryW GetActiveProcessorCount QueryPerformanceFrequency RtlAddFunctionTable GetModuleFileNameW GetSystemDirectoryA FreeLibrary HeapFree GetSystemFirmwareTable CreateIoCompletionPort FormatMessageA TlsFree TlsGetValue SleepEx WideCharToMultiByte GetProcessHeap DeleteCriticalSection LocalFree QueueUserAPC HeapAlloc LoadLibraryW CloseHandle Process32FirstW TlsAlloc TerminateThread GetCurrentThread SetEvent Process32NextW GetLastError Sleep MultiByteToWideChar CreateEventW CreateToolhelp32Snapshot PostQueuedCompletionStatus WaitForSingleObject GetQueuedCompletionStatus LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForMultipleObjects EnterCriticalSection SetLastError TlsSetValue SetWaitableTimer GetModuleHandleA GetModuleHandleW GetCurrentProcessId GetProcAddress LoadLibraryA TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx GetCurrentThreadId InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx WakeAllConditionVariable WakeConditionVariable GetFileInformationByHandleEx AreFileApisANSI GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW GetExitCodeThread WaitForSingleObjectEx SleepConditionVariableSRW TryAcquireSRWLockExclusive GetLocaleInfoEx RaiseException SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode ConvertThreadToFiberEx ConvertFiberToThread GetACP CreateFiberEx DeleteFiber SwitchToFiber VirtualProtect GetSystemTimeAsFileTime GetFileType GetModuleHandleExW AcquireSRWLockShared AcquireSRWLockExclusive

user32

SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture DisplayConfigGetDeviceInfo GetDisplayConfigBufferSizes QueryDisplayConfig SetWindowDisplayAffinity mouse_event GetUserObjectInformationW GetProcessWindowStation DefWindowProcW GetWindowThreadProcessId wsprintfA MessageBoxW MessageBoxA GetWindowRect DestroyWindow SetWindowPos FindWindowA GetWindowLongW SetWindowRgn IsWindowUnicode GetClientRect LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient SetCapture GetMessageExtraInfo GetKeyState CreateWindowExW UnregisterClassW RegisterClassExW GetAsyncKeyState DispatchMessageW PeekMessageW SetLayeredWindowAttributes TranslateMessage SetWindowLongW PostQuitMessage UpdateWindow GetSystemMetrics ShowWindow SetCursor

gdi32

CreateRoundRectRgn

advapi32

ReportEventW DeregisterEventSource RegOpenKeyExA ControlService SetEntriesInAclA AdjustTokenGroups EqualSid CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid LookupPrivilegeNameW RegEnumKeyExW FreeSid SetThreadToken EnumServicesStatusExW SetSecurityInfo ConvertSidToStringSidW RegDeleteValueW OpenServiceW GetUserNameW DuplicateTokenEx QueryServiceStatusEx RegEnumValueW LookupAccountNameW GetSecurityInfo GetTokenInformation RegSetKeyValueW RegCreateKeyExW RegDeleteTreeW RegSetValueExW RegCreateKeyW RegOpenKeyW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegGetValueW RegOpenKeyExW RegQueryValueExW RegCloseKey RegSetValueExA RegisterEventSourceW

shell32

ShellExecuteW ShellExecuteA CommandLineToArgvW

ole32

CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize CLSIDFromString StringFromGUID2 CoSetProxyBlanket

oleaut32

VariantClear SysFreeString SysAllocString VariantInit

ws2_32

htons ioctlsocket setsockopt WSAGetLastError getsockopt WSAStartup WSARecv connect WSASocketW WSAStringToAddressW WSASetLastError ntohl select WSASend closesocket ntohs gethostbyname inet_addr htonl inet_ntoa gethostbyaddr getservbyport recv send socket shutdown getservbyname WSACleanup

bcrypt

BCryptGenRandom

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiOpenDevRegKey

ncrypt

NCryptOpenStorageProvider NCryptGetProperty NCryptFreeObject

ntdll

NtQuerySystemInformation RtlLookupFunctionEntry RtlCaptureContext RtlPcToFileHeader RtlInitAnsiString RtlFreeUnicodeString RtlAnsiStringToUnicodeString RtlInitUnicodeString RtlVirtualUnwind

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

shlwapi

PathFileExistsW

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ae~b~

Size

41.0MB

Virtual Size

41.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_e0ee6b106032619dd21dfa553d2adf7b_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

bcrypt

setupapi

ncrypt

ntdll

d3dx11_43

d3d11

shlwapi

imm32

d3dcompiler_43

dwmapi

generic