2026-07-28_564dc4c18709fdf2c680689d3b56884f_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_564dc4c18709fdf2c680689d3b56884f_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc
Size 9.1MB
Sample260728-g6ctlsff49
SHA256 6df033f1a5c1592e64f9c347daf58129162d8f73e6a0e947e3e8b115399bca4c
MD5 564dc4c18709fdf2c680689d3b56884f
SHA1 48b18732931532877a38e0e7f02238e30405b7da
SHA512 0eac9ba48e02a70f344a05b6073ac2e2f2eeaf4dec7bf178b26313dde0c761a7ccccbb71a9ea4715e718170f3d72ad1596dcbda09161604b2e23af121deb53d2
SSDEEP 196608:sq9j4CgoobwSMzXIcDf5G3A7cT/k1aAEvB3GN1V:sq9j4CgoAICYcTcG2ND
TLSH
T152A61292A6D800FCD19BC7348243760AFAB134A95B34AADF17C059522F73ED54E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_564dc4c18709fdf2c680689d3b56884f_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc

File Explorer

2026-07-28_564dc4c18709fdf2c680689d3b56884f_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc

.exe 9.1MB

2026-07-28_564dc4c18709fdf2c680689d3b56884f_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc

IMPHASH bdf0cee931ee24c153a38cce7b0b0d47
SHA256 6df033f1a5c1592e64f9c347daf58129162d8f73e6a0e947e3e8b115399bca4c
MD5 564dc4c18709fdf2c680689d3b56884f
SHA1 48b18732931532877a38e0e7f02238e30405b7da
SHA512 0eac9ba48e02a70f344a05b6073ac2e2f2eeaf4dec7bf178b26313dde0c761a7ccccbb71a9ea4715e718170f3d72ad1596dcbda09161604b2e23af121deb53d2
SSDEEP 196608:sq9j4CgoobwSMzXIcDf5G3A7cT/k1aAEvB3GN1V:sq9j4CgoAICYcTcG2ND
TLSH
T152A61292A6D800FCD19BC7348243760AFAB134A95B34AADF17C059522F73ED54E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1303432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9

kernel32

FreeLibrary QueryPerformanceCounter GetCurrentProcess K32GetModuleInformation K32EnumDeviceDrivers TerminateProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW DeviceIoControl GetCurrentThreadId CreateFileA FindFirstFileA FindNextFileA FindClose InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent FormatMessageA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc FlushFileBuffers ReadConsoleW GetConsoleMode GetConsoleOutputCP SetFilePointerEx WriteFile GetStdHandle GetModuleFileNameW GetFileType GetModuleHandleExW GetProcAddress ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar CreateProcessA ExitProcess LocalFree FindResourceW LoadResource CloseHandle DeleteFileW LockResource GetLastError Sleep IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetStdHandle EnumSystemLocalesW GetUserDefaultLCID UnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx DecodePointer EncodePointer GetSystemTimeAsFileTime InitializeCriticalSectionEx LCMapStringEx WakeAllConditionVariable IsValidLocale SetFileAttributesW OpenProcess WaitForSingleObject CreateMutexW GetCommandLineW SizeofResource GetModuleFileNameA GetCurrentProcessId WriteConsoleW FreeLibraryAndExitThread SetEndOfFile GetLocaleInfoW LCMapStringW CompareStringW GetCurrentDirectoryW CreateDirectoryW CreateFileW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx GetLocaleInfoEx InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW

user32

SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture PeekMessageA GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture MessageBoxA IsIconic IsWindowUnicode ScreenToClient GetWindowLongW DefWindowProcW GetWindowRect SetWindowPos SetWindowRgn CreateWindowExW RegisterClassExW ShowWindow SetWindowLongW GetDesktopWindow UpdateWindow GetKeyState GetMessageExtraInfo

gdi32

CreateRoundRectRgn

advapi32

AdjustTokenPrivileges RegGetValueW RegSetValueExW RegCreateKeyExW RegCloseKey RegOpenKeyW RegCreateKeyW RegDeleteTreeW OpenProcessToken LookupPrivilegeValueW CryptAcquireContextW CryptReleaseContext CryptGenRandom ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHGetFolderPathW CommandLineToArgvW

ntdll

RtlLookupFunctionEntry RtlCaptureContext NtLoadDriver RtlVirtualUnwind NtUnloadDriver NtAlpcSendWaitReceivePort NtAlpcDisconnectPort RtlCreateUnicodeString NtClose RtlFreeUnicodeString NtAlpcConnectPort RtlInitUnicodeString

ws2_32

WSAGetLastError setsockopt ioctlsocket freeaddrinfo WSAPoll getsockopt recv connect ntohs socket send getsockname getpeername WSAStartup getaddrinfo inet_pton WSASocketW shutdown closesocket WSACleanup htons recvfrom sendto getnameinfo

crypt32

CertOpenSystemStoreW CertEnumCertificatesInStore CertCloseStore CertFreeCertificateContext CertOpenSystemStoreA

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

703KB

Virtual Size

702KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.token

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6.8MB

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_564dc4c18709fdf2c680689d3b56884f_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc

d3d9

kernel32

user32

gdi32

advapi32

shell32

ntdll

ws2_32

crypt32

imm32

generic