2026-07-31_b0c34feff5ff73d8fadb6108b176b564_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_b0c34feff5ff73d8fadb6108b176b564_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 3.6MB
Sample260731-vlfxesdg34
SHA256 ca838e605d05b9a3663c8d592adb42752d7e594663f30406ea7715c664b51e3a
MD5 b0c34feff5ff73d8fadb6108b176b564
SHA1 8d721f9eb4f015ada30c9903eaa3bc68d034cd0b
SHA512 b2ecdcce0a33fff8c90387a7452eafd01fb6866e21654a9eb55a8ab9df8a4a6e20f1f2d30e84a2ba8b551d66d0c9419a861efef740391b5fd4a0244f9b00794a
SSDEEP 49152:rmxllvYGSLAQcrEraeZ6YsXzjCKK+37wtMa/hmPpe5cFHSFCo8R431o0+EjB:rirQcrc5tLh+eiIz801o0L
TLSH
T150069F52A7A801E8D9F6C138C956C523E7F2B85913729BCF07E049761F23AE25E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_b0c34feff5ff73d8fadb6108b176b564_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-31_b0c34feff5ff73d8fadb6108b176b564_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 3.6MB

2026-07-31_b0c34feff5ff73d8fadb6108b176b564_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH a8484dd252801c6634b059d4e01025cb
SHA256 ca838e605d05b9a3663c8d592adb42752d7e594663f30406ea7715c664b51e3a
MD5 b0c34feff5ff73d8fadb6108b176b564
SHA1 8d721f9eb4f015ada30c9903eaa3bc68d034cd0b
SHA512 b2ecdcce0a33fff8c90387a7452eafd01fb6866e21654a9eb55a8ab9df8a4a6e20f1f2d30e84a2ba8b551d66d0c9419a861efef740391b5fd4a0244f9b00794a
SSDEEP 49152:rmxllvYGSLAQcrEraeZ6YsXzjCKK+37wtMa/hmPpe5cFHSFCo8R431o0+EjB:rirQcrc5tLh+eiIz801o0L
TLSH
T150069F52A7A801E8D9F6C138C956C523E7F2B85913729BCF07E049761F23AE25E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

694828

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

EOSBootstrapper-Win64-Shipping.pdb

ws2_32

WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSACreateEvent WSAWaitForMultipleEvents ioctlsocket getpeername freeaddrinfo getaddrinfo recv WSACloseEvent htonl getsockname connect bind accept select __WSAFDIsSet WSAIoctl setsockopt socket htons inet_pton WSACleanup send listen WSAStartup inet_ntop WSASetLastError ntohs WSAGetLastError closesocket getsockopt

kernel32

CreateProcessW GetSystemInfo GetVersionExW GetNativeSystemInfo CreateJobObjectW AssignProcessToJobObject SetInformationJobObject QueryInformationJobObject FreeLibrary GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource EnumResourceLanguagesExW FindResourceW EnumResourceNamesW LocalFree ResumeThread BeginUpdateResourceW UpdateResourceW EndUpdateResourceW GetConsoleScreenBufferInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError QueryPerformanceCounter GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA LoadLibraryA Sleep MultiByteToWideChar WideCharToMultiByte MoveFileExA WaitForSingleObjectEx CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA SleepEx VerSetConditionMask VerifyVersionInfoW CreateFileA GetFileSizeEx ReadFile GetACP GetExitCodeProcess GetCurrentProcess WaitForSingleObject GetLastError CloseHandle IsDebuggerPresent CreateFileW SetEnvironmentVariableW GetStdHandle GetModuleHandleW OutputDebugStringW ExpandEnvironmentStringsW GetOEMCP GetCommandLineA IsValidCodePage SetConsoleCtrlHandler GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap DeleteFileW HeapSize WriteConsoleW GetSystemTime SystemTimeToFileTime GetEnvironmentVariableW SetConsoleMode ReadConsoleA SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber LoadLibraryW FormatMessageW GetStringTypeW SetEndOfFile SetStdHandle FlushFileBuffers SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FormatMessageA RtlUnwind GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI CopyFileW GetFileInformationByHandleEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetFileType GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateThread ExitThread FreeLibraryAndExitThread ExitProcess WriteFile GetConsoleMode ReadConsoleW GetConsoleOutputCP HeapFree HeapAlloc HeapReAlloc GetTimeZoneInformation FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW

advapi32

CreateProcessAsUserW RegOpenKeyExW RegQueryValueExW CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource SaferCreateLevel SaferCloseLevel SaferComputeTokenFromLevel CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData RegCloseKey CryptDestroyHash

ole32

CoCreateGuid

crypt32

CertOpenStore CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertFindCertificateInStore CryptStringToBinaryA CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertDuplicateCertificateContext CertGetCertificateContextProperty PFXImportCertStore CertFreeCertificateChain

imagehlp

ImageRemoveCertificate ImageEnumerateCertificates

bcrypt

BCryptGenRandom

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

763KB

Virtual Size

762KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

596KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_b0c34feff5ff73d8fadb6108b176b564_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

ws2_32

kernel32

advapi32

ole32

crypt32

imagehlp

bcrypt

user32

generic