2026-07-20_fef5bf0c2dc9f46dc2c7ed336ee3401a_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_fef5bf0c2dc9f46dc2c7ed336ee3401a_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 3.6MB
Sample260720-xa9fpsdv3x
SHA256 37dd0ce1962eca7f000806ecc229215d01364ba7c8cdcd8d458a27ab0996ed79
MD5 fef5bf0c2dc9f46dc2c7ed336ee3401a
SHA1 34ea2364dc78028273179769050370b1ee3f5f48
SHA512 8b69d79f58ed73f97d5ad336916a69e04609d0f4468f28a4deae1b59330072534251a772f485124f34e517234f9ffc82f7e75b434fc351bf463fe06826f4cfb9
SSDEEP 49152:E0H2E9NkriFLC/afAEIP6J+5pakVBoIoWk2ByJJdJC2GmQXNYIOEbYJobdPRzYTz:Z4uSm6z9E2bLz2/MfJ5HUWeZE9
TLSH
T1DB06C057A7A401E8C4B7C178CA578903E7F1B8451371ABDB03F19AA52F63AE15E3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_fef5bf0c2dc9f46dc2c7ed336ee3401a_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-20_fef5bf0c2dc9f46dc2c7ed336ee3401a_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 3.6MB

2026-07-20_fef5bf0c2dc9f46dc2c7ed336ee3401a_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 22ee034c90820e989a507c97d4674575
SHA256 37dd0ce1962eca7f000806ecc229215d01364ba7c8cdcd8d458a27ab0996ed79
MD5 fef5bf0c2dc9f46dc2c7ed336ee3401a
SHA1 34ea2364dc78028273179769050370b1ee3f5f48
SHA512 8b69d79f58ed73f97d5ad336916a69e04609d0f4468f28a4deae1b59330072534251a772f485124f34e517234f9ffc82f7e75b434fc351bf463fe06826f4cfb9
SSDEEP 49152:E0H2E9NkriFLC/afAEIP6J+5pakVBoIoWk2ByJJdJC2GmQXNYIOEbYJobdPRzYTz:Z4uSm6z9E2bLz2/MfJ5HUWeZE9
TLSH
T1DB06C057A7A401E8C4B7C178CA578903E7F1B8451371ABDB03F19AA52F63AE15E3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1032464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\agent\workspace\p-34eb88c94f1449d1b342f8071f58cae7\src\bugly_windows_build_env\crashpad\out\x64_release\crashpad_handler.pdb

kernel32

EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection SetLastError GetFileInformationByHandleEx RegisterWaitForSingleObject TerminateProcess GetQueuedCompletionStatus OpenEventW DuplicateHandle DisconnectNamedPipe PostQueuedCompletionStatus CreateEventW Sleep SetEvent UnregisterWaitEx ReadProcessMemory CreateIoCompletionPort LoadLibraryExW ConnectNamedPipe OpenEventA CreateEventA FindFirstFileExW RemoveDirectoryW GetFileTime ExitProcess GetStdHandle SetEndOfFile UnlockFileEx SetFilePointerEx LockFileEx GetFileType FindClose FindNextFileW SetNamedPipeHandleState CreateNamedPipeW GetVersion TransactNamedPipe WaitNamedPipeW ReleaseSemaphore CreateSemaphoreW GetSystemTimeAsFileTime FormatMessageA LocalFree InitOnceExecuteOnce GetTimeZoneInformation VerSetConditionMask VerifyVersionInfoW Wow64GetThreadContext SuspendThread ResumeThread GetThreadContext GetSystemDefaultLCID GetThreadLocale GetUserDefaultLCID CreateProcessW SwitchToThread IsWow64Process WriteProcessMemory GetExitCodeThread VirtualAllocEx SleepEx IsDebuggerPresent UnmapViewOfFile CreateFileMappingW MapViewOfFile SizeofResource FormatMessageW GlobalAlloc GlobalFree FindResourceExW IsDBCSLeadByte LoadResource FindResourceW GlobalLock lstrcpyW GlobalUnlock GetSystemDirectoryW VirtualProtect IsProcessorFeaturePresent GetCurrentThreadId GetModuleHandleA GetFileSizeEx ReadFile DeleteFileA CreateFileA DeviceIoControl WideCharToMultiByte MultiByteToWideChar CreateThread LoadLibraryW DeleteFileW WaitForSingleObject GetSystemInfo GetModuleFileNameA GetCurrentProcess WritePrivateProfileSectionW GetLocalTime GetPrivateProfileStringW CreateFileW GetPrivateProfileSectionW WriteFile CreateTimerQueue DeleteTimerQueueTimer DeleteTimerQueueEx CreateTimerQueueTimer CloseHandle OpenProcess GetProcessTimes GlobalMemoryStatusEx GetCurrentProcessId GetDiskFreeSpaceExW K32GetProcessMemoryInfo OutputDebugStringW GetFileAttributesW K32GetModuleFileNameExW GetProcessId OutputDebugStringA WritePrivateProfileStringW CreateDirectoryW SetUnhandledExceptionFilter GetModuleHandleW GetProcessHeap DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc RaiseException ReadConsoleA ConvertFiberToThread DeleteFiber VirtualQueryEx MoveFileW HeapQueryInformation GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP SetStdHandle SystemTimeToTzSpecificLocalTime GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread GetCommandLineW GetCommandLineA FreeLibrary RtlPcToFileHeader RtlUnwindEx InitializeSListHead UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo LCMapStringEx EncodePointer SleepConditionVariableSRW WaitForSingleObjectEx GetStringTypeW GetStartupInfoW RtlUnwind HeapReAlloc LoadLibraryA GetLastError HeapSize InitializeCriticalSectionEx SetProcessShutdownParameters GetModuleFileNameW LoadLibraryExA HeapFree LockResource SetConsoleCtrlHandler GetFullPathNameW GetFileInformationByHandle FindFirstFileW LCMapStringW WriteConsoleW ReadConsoleW SetConsoleMode PeekNamedPipe FlushFileBuffers FileTimeToSystemTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSection WakeAllConditionVariable TlsAlloc TlsGetValue TlsSetValue TlsFree GetConsoleMode GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentDirectoryW QueryPerformanceCounter QueryPerformanceFrequency

advapi32

CryptCreateHash RegOpenKeyExA RegQueryValueExA RegCloseKey RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteValueW ImpersonateNamedPipeClient SystemFunction036 DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptDestroyHash CryptSignHashW CryptEnumProvidersW RevertToSelf InitializeSecurityDescriptor SetSecurityDescriptorDacl BuildSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW

user32

SetWindowPos GetWindowRect CallWindowProcW GetKeyState RegisterClipboardFormatW DestroyMenu IsWindow TrackPopupMenu GetDlgItem DrawTextW DrawIconEx GetSysColorBrush DialogBoxParamW LoadImageW InvalidateRect BeginPaint EndPaint EnableWindow SetTimer CreatePopupMenu GetMenuItemCount SendMessageW UnregisterClassW SetWindowTextW ShowWindow OpenClipboard GetSystemMetrics TranslateMessage RegisterClassW DispatchMessageW GetWindowLongPtrW CreateWindowExW SetWindowLongPtrW DestroyWindow GetWindowThreadProcessId GetWindowTextW ClientToScreen CloseClipboard EmptyClipboard SetDlgItemTextW MapWindowPoints SendDlgItemMessageW SetClipboardData MapDialogRect EndDialog GetWindowTextLengthW MessageBoxW GetUserObjectInformationW GetProcessWindowStation PostMessageW DefWindowProcW GetMessageW KillTimer GetClientRect

winhttp

WinHttpCloseHandle WinHttpWriteData WinHttpOpenRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse

powrprof

CallNtPowerInformation

ole32

DoDragDrop OleUninitialize CoTaskMemFree StringFromCLSID OleInitialize CoSetProxyBlanket CoInitializeEx CoCreateInstance CoCreateGuid

shlwapi

PathFileExistsW PathFileExistsA PathRemoveFileSpecW

shell32

SHGetDesktopFolder ShellExecuteW SHGetFileInfoW ord155 SHBindToParent

gdiplus

GdiplusStartup

comctl32

ImageList_ReplaceIcon InitCommonControlsEx ImageList_Create

gdi32

SetBkMode SetTextColor GetStockObject CreateFontW SelectObject DeleteObject

oleaut32

SysAllocStringByteLen SysAllocString SysFreeString SysStringLen SysStringByteLen

ws2_32

closesocket WSAGetLastError WSASetLastError WSACleanup recv send

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

crypt32

CertFreeCertificateContext CertCloseStore CertOpenStore CertGetCertificateContextProperty CertFindCertificateInStore CertEnumCertificatesInStore CertDuplicateCertificateContext

bcrypt

BCryptGenRandom

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

773KB

Virtual Size

773KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

592KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_fef5bf0c2dc9f46dc2c7ed336ee3401a_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

user32

winhttp

powrprof

ole32

shlwapi

shell32

gdiplus

comctl32

gdi32

oleaut32

ws2_32

version

crypt32

bcrypt

generic