2026-08-03_c40c44ad279c890afe6a427aee0b4697_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_poet-rat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_c40c44ad279c890afe6a427aee0b4697_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_poet-rat_stealc
Size 43.6MB
Sample260803-hdn7lsdd55
SHA256 2cbd831475a7d625378f987826a894a1c9fdce30d73155d32d3b62196af89fbb
MD5 c40c44ad279c890afe6a427aee0b4697
SHA1 a89bf253c370e86a8111bcd000364fd2cf86436b
SHA512 3e2e1ea9e8a2e302edca81b8f78ed0daa5d4a9ce28931062555c2f81af95f47a85ca69ff78f7d178b0ff75d16dc28a287581211e41c1c9b82ec380817b30210d
SSDEEP 393216:LVwzHYYZzF/o+bNgYa4Es6x/DUwy7W4BIPSLYZnvEzyNQqgxxTVXKG00tiPYaiaV:yY8KYcOEkxTjlM5QQ
TLSH
T1B3A77D4AB3B910D6F136C03D871AA117E6B33434037047EB41B24767AFABAE51D7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-03_c40c44ad279c890afe6a427aee0b4697_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_poet-rat_stealc

.exe 43.6MB

2026-08-03_c40c44ad279c890afe6a427aee0b4697_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_poet-rat_stealc

IMPHASH 20598388d469a590ebe6bb081f92a231
SHA256 2cbd831475a7d625378f987826a894a1c9fdce30d73155d32d3b62196af89fbb
MD5 c40c44ad279c890afe6a427aee0b4697
SHA1 a89bf253c370e86a8111bcd000364fd2cf86436b
SHA512 3e2e1ea9e8a2e302edca81b8f78ed0daa5d4a9ce28931062555c2f81af95f47a85ca69ff78f7d178b0ff75d16dc28a287581211e41c1c9b82ec380817b30210d
SSDEEP 393216:LVwzHYYZzF/o+bNgYa4Es6x/DUwy7W4BIPSLYZnvEzyNQqgxxTVXKG00tiPYaiaV:yY8KYcOEkxTjlM5QQ
TLSH
T1B3A77D4AB3B910D6F136C03D871AA117E6B33434037047EB41B24767AFABAE51D7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

fb:ea:19:c8:95:96:38:94:45:15:30:81:4e:fe:40:46:ac:7a:e8:dd:85:cd:1d:5e:39:e8:06:5e:fc:11:5a:86

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Digital Extremes Ltd.,O=Digital Extremes Ltd.,L=London,ST=Ontario,C=CA

Chains

Jul 29, 2026

CN=Digital Extremes Ltd.,O=Digital Extremes Ltd.,L=London,ST=Ontario,C=CA

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Digital Extremes Ltd.,O=Digital Extremes Ltd.,L=London,ST=Ontario,C=CA

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Digital Extremes Ltd.,O=Digital Extremes Ltd.,L=London,ST=Ontario,C=CA

Serial Number

0d:17:77:79:62:3a:77:e5:91:78:d0:8b:08:22:f6:70

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 6, 2023 - Sep 17, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

29525336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

s:\SoulframePublic\Code\EE.x64.Retail.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

waveInReset waveInStart waveInAddBuffer waveInPrepareHeader waveInClose waveInOpen waveInMessage waveInGetDevCapsW waveInGetNumDevs timeEndPeriod timeBeginPeriod timeGetDevCaps

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

imm32

ImmGetDefaultIMEWnd ImmGetDescriptionW ImmGetContext ImmSetCandidateWindow ImmNotifyIME ImmGetCandidateListW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

dwmapi

DwmGetCompositionTimingInfo

ws2_32

WSAEnumNetworkEvents WSACreateEvent WSACloseEvent socket setsockopt sendto select getsockopt WSAStartup WSACleanup WSAGetLastError WSAEventSelect WSAIoctl accept WSAResetEvent WSASetLastError closesocket WSAWaitForMultipleEvents getaddrinfo recvfrom ntohs htons getsockname bind freeaddrinfo inet_pton inet_ntop __WSAFDIsSet connect recv send WSAStringToAddressW htonl inet_ntoa ntohl listen ioctlsocket

winhttp

WinHttpReceiveResponse WinHttpQueryHeaders WinHttpCrackUrl WinHttpQueryAuthSchemes WinHttpSetCredentials WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpCloseHandle WinHttpSetOption WinHttpReadData WinHttpConnect WinHttpOpen

kernel32

GetThreadPriority GetVersionExW GetDiskFreeSpaceExW GetCurrencyFormatW GetComputerNameExA GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime K32GetPerformanceInfo WriteConsoleW GetConsoleWindow FormatMessageW LocalFree GetProcessHeap MoveFileExA GetEnvironmentVariableA CompareFileTime LoadLibraryA GetModuleHandleA GetSystemDirectoryA GetTickCount ReadConsoleA GetEnvironmentVariableW ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SleepEx SwitchToThread GetTickCount64 QueryPerformanceCounter GetCurrentProcess GetProcessHandleCount K32GetProcessMemoryInfo GetStdHandle CreateFileW OutputDebugStringA AllocConsole FreeConsole GetConsoleMode SetConsoleMode WriteConsoleA SetConsoleTitleA RtlCaptureContext CreateDirectoryW DeleteFileW GetFileAttributesW SetFileAttributesW IsDebuggerPresent CloseHandle SetUnhandledExceptionFilter GetLastError SetLastError AddVectoredExceptionHandler WaitForSingleObject GetCurrentProcessId TerminateProcess CreateThread GetCurrentThreadId GetExitCodeThread SuspendThread ResumeThread CreateProcessW GetThreadContext VirtualAlloc VirtualFree VirtualQueryEx GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExA LoadLibraryW CopyFileW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW GetFinalPathNameByHandleW GetFullPathNameW GetLongPathNameW GetShortPathNameW QueryDosDeviceW ReadFileEx WriteFileEx SetHandleInformation CreatePipe DisconnectNamedPipe CreateNamedPipeW WaitForSingleObjectEx GetExitCodeProcess GetLogicalProcessorInformationEx CreateJobObjectW AssignProcessToJobObject TerminateJobObject SetProcessAffinityMask GetModuleHandleW QueryPerformanceFrequency GetSystemInfo VirtualProtect VirtualQuery ReleaseSemaphore CreateSemaphoreW GetCurrentThread SetThreadPriority TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS GetFileSizeEx ReadFile SetEndOfFile SetFilePointerEx WriteFile DuplicateHandle GetSystemTime SystemTimeToFileTime FormatMessageA CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GlobalAlloc GlobalUnlock GlobalLock GlobalFree SetEvent CreateEventW MulDiv GetOverlappedResult FindClose FindFirstFileW FindNextFileW Sleep ReadDirectoryChangesW FindFirstFileExW GetFileAttributesExW RemoveDirectoryW MoveFileW GetProcessTimes ResetEvent ReleaseMutex CreateMutexA CreateEventA CreateSemaphoreA VerSetConditionMask VerifyVersionInfoW WideCharToMultiByte FreeLibrary K32EnumProcessModules ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive CreateEventExW InitializeSRWLock WaitForMultipleObjects GetCurrentDirectoryW GetSystemPowerStatus GetLocaleInfoW CreateMutexW GlobalMemoryStatusEx SetConsoleCtrlHandler K32EnumPageFilesW GetTempPathW SetWaitableTimer CreateWaitableTimerW OpenProcess GetLocalTime GetComputerNameExW CreateTimerQueue DeleteTimerQueueEx SetThreadExecutionState GetUserDefaultLangID CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW K32GetProcessImageFileNameW SetFileInformationByHandle SetFileValidData CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus MoveFileExW RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent SleepConditionVariableSRW GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW OutputDebugStringW LocalAlloc GetSystemDirectoryW GetStringTypeW LoadLibraryExW GetModuleFileNameA RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetConsoleCP ExitProcess GetTimeZoneInformation HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetFileType FlushFileBuffers GetConsoleOutputCP MultiByteToWideChar GetNumberOfConsoleInputEvents ReadConsoleInputW PeekConsoleInputA ReadConsoleW HeapReAlloc HeapSize HeapQueryInformation IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle SwitchToFiber

user32

EmptyClipboard OpenClipboard SetClipboardData MessageBoxA GetProcessWindowStation CloseClipboard GetClipboardData BeginPaint EnumDisplayMonitors EnumChildWindows EnumWindows GetWindowThreadProcessId GetGuiResources MoveWindow GetKeyState GetAsyncKeyState GetDC ReleaseDC GetWindowRect ShowCursor SystemParametersInfoW GetCursorInfo SendMessageW CreateWindowExW IsChild IsWindowVisible BringWindowToTop DialogBoxIndirectParamW EndDialog SetFocus GetFocus EnableWindow IsWindowEnabled DrawTextW GetForegroundWindow SetForegroundWindow InvalidateRect SetWindowTextW AdjustWindowRect MessageBoxW GetWindowLongPtrW SetWindowLongPtrW GetWindow MapDialogRect GetWindowInfo VkKeyScanW MonitorFromRect GetMonitorInfoW PostQuitMessage MonitorFromWindow ShowWindow IsIconic GetClientRect DefWindowProcW UnregisterClassW RegisterClassExW IsWindow DestroyWindow CloseWindow SetWindowPos GetSystemMetrics SetMenu GetWindowLongW SetWindowLongW LoadCursorW SetProcessDPIAware IsProcessDPIAware LockSetForegroundWindow GetKeyboardState GetKeyNameTextW GetCapture SetCapture ReleaseCapture SetCursorPos GetCursorPos ClientToScreen ScreenToClient MapWindowPoints ClipCursor PtInRect GetKeyboardLayout SendMessageA TranslateMessage DispatchMessageW PeekMessageW IsZoomed SetTimer KillTimer GetMenu DrawMenuBar EnableMenuItem GetSubMenu GetMenuItemCount EnumDisplayDevicesW EndPaint AdjustWindowRectEx SetCursor FillRect GetClassNameW LoadIconW EnumDisplaySettingsW GetUserObjectInformationW

gdi32

DeleteObject SelectObject CreateFontIndirectW GetDeviceCaps GetStockObject

advapi32

RegisterEventSourceW CryptEnumProvidersW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW GetUserNameW RegEnumKeyExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey DeregisterEventSource CryptSignHashW ReportEventW CryptAcquireContextW CryptReleaseContext

shell32

SHGetFolderPathW SHCreateDirectoryExW ShellExecuteW

ole32

CoTaskMemAlloc OleUninitialize OleInitialize CoCreateGuid PropVariantClear CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree

iphlpapi

GetBestInterfaceEx GetAdaptersInfo

crypt32

CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertCloseStore CertGetCertificateContextProperty CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertOpenStore

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

Name

.text

Size

32.1MB

Virtual Size

32.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.0MB

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.4MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.shr

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

509KB

Virtual Size

509KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

757KB

Virtual Size

757KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=214, id=261, version=33145,

count=38, id=259, version=33145,

count=2, id=262, version=33145,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=8, id=253, version=35207,

count=28, id=259, version=35207,

count=20, id=260, version=35207,

count=4, id=260, version=35226,

count=54, id=261, version=35207,

count=88, id=260, version=33145,

count=75, id=261, version=27038,

count=36, id=261, version=35215,

count=38, productName=Unmarked objects (old),

count=35, id=257, version=33145,

count=4, id=261, version=34808,

count=1, id=259, version=34808,

count=866, id=260, version=35215,

count=8, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=684, id=1, productName=Unmarked objects,

count=2527, id=261, version=35226,

count=1, id=256, version=35226,

count=1, id=255, version=35226,

count=1, id=258, version=35226,