2026-08-04_b9d9767e9b81aba4b2de86afd2a8aa2a_coinminer_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_b9d9767e9b81aba4b2de86afd2a8aa2a_coinminer_glassworm_icedid_njrat_vidar
Size 22.1MB
Sample260804-rrysmsy1cx
SHA256 1c1e77e45c02df4f43cb731d667f13d1262ae1ea7eeab34b814618bd3fefbcd5
MD5 b9d9767e9b81aba4b2de86afd2a8aa2a
SHA1 8c90350cae747267b75fd786afd9b88a8ff9ef3b
SHA512 908d0fb6fe7cebea753b0284b9a2461c5b7841f88919ec16ce6e4a6031f1622d71dea2cba1931b58fedc3838f16755ef85619baf549848a5016d7de236d204ec
SSDEEP 393216:/LngCsxiUKj/PlepP0dOsHPpRHw4J5biY03AAwHRugAp:/LgTaLlepcdOsHRdrJ5bimAwHRugA
TLSH
T19A3712DAE1D520B4E8D38670958E179AE2F1705A87755AEF32C209015F33EE7863DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_b9d9767e9b81aba4b2de86afd2a8aa2a_coinminer_glassworm_icedid_njrat_vidar

File Explorer

2026-08-04_b9d9767e9b81aba4b2de86afd2a8aa2a_coinminer_glassworm_icedid_njrat_vidar

.exe 22.1MB

2026-08-04_b9d9767e9b81aba4b2de86afd2a8aa2a_coinminer_glassworm_icedid_njrat_vidar

IMPHASH 9ef24d48778aaa7e653071bc426abd77
SHA256 1c1e77e45c02df4f43cb731d667f13d1262ae1ea7eeab34b814618bd3fefbcd5
MD5 b9d9767e9b81aba4b2de86afd2a8aa2a
SHA1 8c90350cae747267b75fd786afd9b88a8ff9ef3b
SHA512 908d0fb6fe7cebea753b0284b9a2461c5b7841f88919ec16ce6e4a6031f1622d71dea2cba1931b58fedc3838f16755ef85619baf549848a5016d7de236d204ec
SSDEEP 393216:/LngCsxiUKj/PlepP0dOsHPpRHw4J5biY03AAwHRugAp:/LgTaLlepcdOsHRdrJ5bimAwHRugA
TLSH
T19A3712DAE1D520B4E8D38670958E179AE2F1705A87755AEF32C209015F33EE7863DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10216161

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetEvent CloseHandle SetUnhandledExceptionFilter WaitForSingleObject VirtualFree lstrlenW GetModuleHandleExW VirtualAlloc GetModuleFileNameW CreateFileW UnmapViewOfFile GetModuleHandleA GetLogicalDriveStringsW GetLastError GetNativeSystemInfo LoadLibraryW GetProcAddress CreateProcessW GetModuleHandleW FreeLibrary CreateFileMappingW MapViewOfFile TryEnterCriticalSection EnterCriticalSection OpenEventW LeaveCriticalSection CreateMutexW ReleaseMutex DeleteCriticalSection OpenMutexW GetModuleFileNameA GetCurrentThreadId CreateFileA FileTimeToSystemTime LoadLibraryA GetCurrentProcessId MultiByteToWideChar WideCharToMultiByte ReadFile VirtualProtect HeapFree SetLastError ExitThread HeapAlloc GetProcessHeap GetFullPathNameW GetCurrentDirectoryW SystemTimeToTzSpecificLocalTime PeekNamedPipe RtlUnwind CreateEventW GetCurrentProcess InitializeCriticalSectionAndSpinCount GetTickCount SetConsoleMode ConvertFiberToThread DeleteFiber GetEnvironmentVariableW SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindFirstFileW FindNextFileW DeviceIoControl InitializeProcThreadAttributeList CreatePipe FindClose LocalAlloc Sleep GetTimeZoneInformation UpdateProcThreadAttribute GetDiskFreeSpaceExW LocalFree GetComputerNameW lstrcpyW GetDriveTypeW GetComputerNameA GetVersionExW FileTimeToLocalFileTime SizeofResource HeapSize LockResource HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW DecodePointer HeapDestroy GlobalAlloc GlobalFree ResetEvent ReadConsoleA GetConsoleMode GetFileAttributesW RtlPcToFileHeader EncodePointer DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread QueryPerformanceCounter GetStringTypeW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwindEx ExitProcess GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP GetFileType GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetFileAttributesExW CreateDirectoryW ReadConsoleW SetFilePointerEx SetConsoleCtrlHandler GetSystemTimeAsFileTime CreateEventA GetModuleHandleA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree HeapAlloc HeapFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers FlsSetValue GetCommandLineA GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException RtlPcToFileHeader RtlUnwindEx LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

user32

MessageBoxW GetUserObjectInformationW GetProcessWindowStation wsprintfW EnumDisplayDevicesW GetSystemMetrics GetDC

ws2_32

htons sendto recvfrom socket ntohl setsockopt WSAStartup inet_ntoa gethostname closesocket htonl WSACleanup WSAGetLastError recv send WSASetLastError

pdh

PdhOpenQueryW PdhCollectQueryData PdhCloseQuery PdhAddCounterW PdhGetFormattedCounterValue

advapi32

DeregisterEventSource ReportEventW RegisterEventSourceW

oleaut32

VarUdateFromDate SysFreeString SysAllocString SysStringLen VariantClear

bcrypt

BCryptGenRandom

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

692KB

Virtual Size

692KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

85KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ep0

Size

6.7MB

Virtual Size

6.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ep1

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ep2

Size

12.5MB

Virtual Size

12.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=13, id=241, version=40116,

count=187, id=243, version=40116,

count=28, id=242, version=40116,

count=2, id=135, version=30729,

count=9, id=259, version=26706,

count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=135, id=261, version=26706,

count=38, id=260, version=26706,

count=2, id=259, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=280, id=1, productName=Unmarked objects,

count=492, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=31, productName=Unmarked objects (old),

count=52, id=265, version=26726,

count=1, id=255, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=151,

count=1, id=258, productName=VS2017 v15.8.0 build 26726, version=26726,