2026-08-04_814c50f388566962ae760d65b8b6899c_coinminer_glassworm_hijackloader_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_814c50f388566962ae760d65b8b6899c_coinminer_glassworm_hijackloader_icedid_mespinoza_njrat_ryuk
Size 2.7MB
Sample260804-hcypnatarf
SHA256 16f69a52fd06048ed7fae02806173327d23d68e28fd26a8e8f021d38c21c6297
MD5 814c50f388566962ae760d65b8b6899c
SHA1 add2c7e3eecd1bdfc31b1840b86b1e2ef5f9bddf
SHA512 a0267a49e989dab0ff7478198548e1493af011ba036230485afa690e54b7c94143f67b4573da6e8cd3f7fc77e02002e3d235dfe2cd0241fcbc8938913152c498
SSDEEP 49152:g8AmstZ14XeeE2yJ6H6gQPoFLMV6FrnFDvqwLyQHJTupyvMFP0+Tips:RQSop6myLIGrqYyQpIcMWc
TLSH
T11CD50222B7404ED7C9934374C826870417A1FE602BA1E36727B5E24D2F7A7A94F27397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_814c50f388566962ae760d65b8b6899c_coinminer_glassworm_hijackloader_icedid_mespinoza_njrat_ryuk

File Explorer

2026-08-04_814c50f388566962ae760d65b8b6899c_coinminer_glassworm_hijackloader_icedid_mespinoza_njrat_ryuk

.exe 2.7MB

2026-08-04_814c50f388566962ae760d65b8b6899c_coinminer_glassworm_hijackloader_icedid_mespinoza_njrat_ryuk

IMPHASH e01d22dff68462c68893740b8f5bd062
SHA256 16f69a52fd06048ed7fae02806173327d23d68e28fd26a8e8f021d38c21c6297
MD5 814c50f388566962ae760d65b8b6899c
SHA1 add2c7e3eecd1bdfc31b1840b86b1e2ef5f9bddf
SHA512 a0267a49e989dab0ff7478198548e1493af011ba036230485afa690e54b7c94143f67b4573da6e8cd3f7fc77e02002e3d235dfe2cd0241fcbc8938913152c498
SSDEEP 49152:g8AmstZ14XeeE2yJ6H6gQPoFLMV6FrnFDvqwLyQHJTupyvMFP0+Tips:RQSop6myLIGrqYyQpIcMWc
TLSH
T11CD50222B7404ED7C9934374C826870417A1FE602BA1E36727B5E24D2F7A7A94F27397
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1559212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Git_NtUniSDK\WCrashHandler\tmpbuild\Release_x64_v140\UniCrashReporter.pdb

zwjr.yrw

UgRcAytPtullPHGO iOctUqjHZlAwOCq VAwkennQnhdw BKMkYXNkBqxuMEqhnO cutnlEsxxbRUk eAhuAMrqUKtZFHIg fWksdyIBZtpatbWSXgXj vPTGqCHDZZkSOnUFsTIT FdkAbDHgYYtYkfRtyDrsPCGlJzA cDQsDjouRFsGeWcsSLSJF BrCcNPK qHXcuIDbAGUzFXTlHINZvdfLG gyaaVUPnUjtzLrkGYgC BdzXlotpQSo RyyBMsndPJCpDrzq EcdTEXWtXROD MNNWQyLLqLLgbMW SRKhnDtkLrINUzVnkrSEFPp kpFvAJnaXWKGibIDGGmFPRz BavBgwegXDoLPQGaRdQAIfJ PYVreEnSRoXl lSRgp LnwACvFfkMGx CHUeUcZoEVQ HHUFFXPKJbGDLuUApZBCO BzKiTRNdYEF xeELmqJuMMzjI VDkSWWONdNWrdZQVpGtUxC aJlMAseiwetuQHLYxNe qtZsylGPpoZAcuPvuB IkUEiXrQEJCMjfvUGRpV OVpRnDtCEnQglCbqPGmTjWJ deVHevwcscaWEH VNhxLDdQGpLCKc SvPLABfrKkpK QhiHUevdwPvb qSlJUJCimRWiPoeTavM aoRosVvh yubLaVkvoCn MAANDvVfFco DIgTlCq cupRzkBsm dZdmtKeUNBBZjKUKsg OqwJeTveWdQJLUbryd ELQpSTcqzSBB uWYYhLjoitKafJ UoLwUqqyHfqWiOlTsEXHodD JVFsWLfZAblxhJzZMhovBmg mmQxKinBdDlkiisPrRvilL PQkHnMmh xbDHykhlvumtfKd GImDxvFIXGwaFRWFIh sMXKJpZkjNkYs gaHPEZFYqVSo brBaIELwhtpuMhnzLyXwB NiABCvEzBDtrh TUKrXgsgilXYWqCT MCDOLhvbswaEwPcrTPD PcrDvhKEXHT JLvIDxale fiDyngIJwqyQlQ nYdMefbfifiCEnuKobiYYKw havWQzzTnvl hoqQnnmUXye JleMHpNjMkTE vOVtOLuvwBjmDQMfLBazFi aQUnyHaNRsgyEY CezQQaAvVkrvEf USUZthIUihROnbBVxFh mgNyRuGelFxJmMzvGBedTyHKIerEzBOGNUooe LClwlFGXKDKegpvr ufnAQhhpVaEItSMD bthagPMDvDfkQowiAgNT wCPKKnADyRhF UDbRymPMxAFD OeLBFxuZpFekEvWkTOCS DQuJgUbdgMxAxbzOjf rCQZJDjYbWfrymoOaw ZohlVdPcDkpyr zXYdaqXaWQsfMY lYXGcrWGsyRZZb kehVbUVaIMmy MnjwMO qqxNCefwCEiCYOi xJrURMqQtqXQpgm ZkovgSgJhUy lKYMEGRU asNePAiti SbXhzbikcwm FpVEbMddVETVSccYIHAXr xoSBFhlTdUofCchH jDxYOrHQEU hxLEAMCcIFnuC fAOFFwByDxqugUGljcJw cuIBxQiFBvwVhxPTKfiTrubSBYsYiAc HQugcVepbDcwlsNe sPouLBlxbns vdwnotvbxWEYSM OeJPVCgJXQrcGhXkZpcxaeg VCbZppOsyHDSdtrwP KlMEjAhgMLkxtLsm MFEwbqwDUffHemRL RwZHQyGIRkKuexD THzXytvRkVYQnaMhgYHpo OZkdxRlTznjchxcjXyTxaiBXT doHbukTcJFMwGVcSJxIuhGUS HmveRPLfPHDROIJj GLuYBQYuMVoIOhw ivzsAeuSXLJmfP MfurDAYfcvq JueZlXEcAtDm xYwcShSahwKKu RxKMQffedgXpFy fmPjvrKGsomsXbvqFxTOKRjN SUCetbyzSIKhpf RHXRIyIygERDtRiZ iPZZRBIwcdCphiRujb kmgVAlYzCMAXNh tsFSsztdfnqRRYIpwsBRLyVaYZH eaxfJTwWYPTSWJQftDmhx hzcHhowmFOarIUzjgoSAoI hVwNYswonyeycMnmolpHtFAH IgwvXMMUDWnmOtwRJlBbR MtbHDJVuBEA NzErNCNoBLV bBIfDKliJ rBHpRPaKwTtIIkJLhR SNCjBuHERSDPD sxPnoamLkDIJl ulAnvBNmIPhpkM eggCkZsA SevsJzLB ARsmefbCZEvnPB slLjCmHRTvAhlWEAwuxLAmE JwiVRIdXKlRMH vgootFLyEMKnQ QhwjZGanzaml uoaFBtQWlwNftX SNQDbazpUJre duudcQzJpgqpFA hXeQUpZwg lvNHHtjw TUrzzSpiad FkGlgobmibzwTRqTw YRtwyohsijUzVTFysPusvF fsDQfBeumMFxgtTa BwmcxErcpayVlOmWLmmDYNRs IgYeeFQKsMjsvHgJErJYtyKMPxA uDyFmTWEHeMMemFws dKwCzBleVUWttDoF ndphIYHcAtIdRDXyJOKjgsMGO uqrZmMtsMEMxMjGxJ ARVqSgquHCKpMgi SEaINjRLMOeaVGwdllV zEWLXbCmMewEsmIkdpA YdEGoVxaEWqZAv QOwAITwGDanw jcpLYAAxlLIrWIMZN xYwneuhlHmIqGPuNu mDUQBFtuhFIRsZzCVZpiPEqZBJBQtx JwTfBuvByvnwobMaGAHeK czGMODfNIANlczekiBLRq

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

695KB

Virtual Size

695KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

66KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_814c50f388566962ae760d65b8b6899c_coinminer_glassworm_hijackloader_icedid_mespinoza_njrat_ryuk

zwjr.yrw

generic