2026-07-30_d9dd5dfd2920820ede37ba52be32eb5f_coinminer_glassworm_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_d9dd5dfd2920820ede37ba52be32eb5f_coinminer_glassworm_icedid_mespinoza_njrat_ryuk
Size 3.3MB
Sample260730-vehsfawvav
SHA256 f7e55be89029277f5b26dd28fda05e7b7e61e37a3cf5cc21084012d9c5903f67
MD5 d9dd5dfd2920820ede37ba52be32eb5f
SHA1 f894616a835691309a29c733da3b1f4258d22439
SHA512 10b641e079a8803d5bb280ef4617a996bb4546926201954003a2012c56e0ce876be022fc4a84b53b971b540eae3cc9ef164a5bc5ebc9c79b238c1b23688db304
SSDEEP 49152:/IkZDh/7sBPa+SGIQQv4e2RTnDSwB89u2/gaFPFeTjN7c6mGvKVO+n1:/Ie7MTDS79ia/scXeN+1
TLSH
T18DF5AE56A3B400E4D9B7C278C9528607E7F2B46617709BCF07B8867A1F23AE11E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_d9dd5dfd2920820ede37ba52be32eb5f_coinminer_glassworm_icedid_mespinoza_njrat_ryuk

File Explorer

2026-07-30_d9dd5dfd2920820ede37ba52be32eb5f_coinminer_glassworm_icedid_mespinoza_njrat_ryuk

.exe 3.3MB

2026-07-30_d9dd5dfd2920820ede37ba52be32eb5f_coinminer_glassworm_icedid_mespinoza_njrat_ryuk

IMPHASH 67c4abce3682d8784972054d0e83a6ea
SHA256 f7e55be89029277f5b26dd28fda05e7b7e61e37a3cf5cc21084012d9c5903f67
MD5 d9dd5dfd2920820ede37ba52be32eb5f
SHA1 f894616a835691309a29c733da3b1f4258d22439
SHA512 10b641e079a8803d5bb280ef4617a996bb4546926201954003a2012c56e0ce876be022fc4a84b53b971b540eae3cc9ef164a5bc5ebc9c79b238c1b23688db304
SSDEEP 49152:/IkZDh/7sBPa+SGIQQv4e2RTnDSwB89u2/gaFPFeTjN7c6mGvKVO+n1:/Ie7MTDS79ia/scXeN+1
TLSH
T18DF5AE56A3B400E4D9B7C278C9528607E7F2B46617709BCF07B8867A1F23AE11E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1633868

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

G:\CrashHunterSDK\wcrashhandler\tmpbuild\Release_x64_v140\UniCrashReporter.pdb

dbghelp

MiniDumpWriteDump

kernel32

MoveFileW IsDebuggerPresent FileTimeToDosDateTime GetStdHandle WriteConsoleA WriteConsoleW GetCurrentThreadId MultiByteToWideChar WideCharToMultiByte UnmapViewOfFile SetEvent GetLocalTime CopyFileW CreateFileMappingW MapViewOfFile GetCurrentProcess WaitForMultipleObjects DuplicateHandle LoadLibraryW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx QueryPerformanceFrequency GetSystemDirectoryA FreeLibrary GetModuleHandleA LoadLibraryA CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA QueryPerformanceCounter GetTickCount SetLastError MoveFileExA WaitForSingleObjectEx GetFileType PeekNamedPipe VerSetConditionMask VerifyVersionInfoA SystemTimeToFileTime GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree WriteFile GetModuleHandleExW GlobalMemoryStatus SetFilePointer SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage GetModuleHandleW GetCurrentProcessId GetFileSize LocalFree GetProcAddress GetCurrentDirectoryW K32EnumProcesses FileTimeToLocalFileTime CloseHandle DeleteFileW FileTimeToSystemTime GetLastError GetTimeZoneInformation FormatMessageW Sleep GetProcessHeap GetEnvironmentVariableW GetSystemTime GetFullPathNameW SetEndOfFile SetStdHandle FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP GetACP GetCommandLineW GetCommandLineA HeapReAlloc HeapFree HeapAlloc ExitProcess SetConsoleCtrlHandler SetFilePointerEx ExitThread GetDriveTypeW SetEnvironmentVariableW SystemTimeToTzSpecificLocalTime FindFirstFileExW GetFileAttributesExW RtlUnwindEx RaiseException RtlPcToFileHeader CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc GetVersionExW LoadLibraryExW FreeLibraryAndExitThread GetThreadTimes GetCurrentThread OutputDebugStringW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread OpenProcess CreateFileW FindClose GetModuleFileNameW RemoveDirectoryW FindNextFileW GetFileSizeEx FindFirstFileW ReadFile HeapSize GetStringTypeW TryEnterCriticalSection EncodePointer DecodePointer CreateEventW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead SignalObjectAndWait SwitchToThread

user32

MessageBoxW GetUserObjectInformationW GetProcessWindowStation

advapi32

ReportEventW RegisterEventSourceW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash DeregisterEventSource

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW

wldap32

ord143 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord200 ord301 ord30

ws2_32

WSAEventSelect listen WSAResetEvent send WSAWaitForMultipleEvents closesocket htonl WSAGetLastError recv bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup __WSAFDIsSet select accept WSACreateEvent getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname shutdown getnameinfo WSAEnumNetworkEvents WSACloseEvent

crypt32

CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore CertFindCertificateInStore CertDuplicateCertificateContext CertGetCertificateContextProperty CertCloseStore

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

722KB

Virtual Size

721KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

67KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

592KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_d9dd5dfd2920820ede37ba52be32eb5f_coinminer_glassworm_icedid_mespinoza_njrat_ryuk

dbghelp

kernel32

user32

advapi32

shell32

wldap32

ws2_32

crypt32

generic