bruteratel | 2026-08-07_30da59942962c06a219d79797bb0e021_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_30da59942962c06a219d79797bb0e021_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 74.4MB
Sample260807-hsshkssxd1
SHA256 ee66d13719eed8b23637e39f0638d085abf86e51cf6f250950bb2720ddb09fe2
MD5 30da59942962c06a219d79797bb0e021
SHA1 d94804b18286c9493dc0140125a57158215574ae
SHA512 3bc51784d6fafed4948a5eacbd501cc7cb5913c50aaf74e1c48bf6a025d6af031fb8c7fd75cbb650e54c635cbacb17154d3db417c6543151aa8c8b8929743849
SSDEEP 1572864:7V5xzLMjfiSVQplVsiX/kXlqBsXIhKnrigPKn1au:7LxzUfiSgrjnzZnJ
TLSH
T1D10801C675D052ECC7D2C134D24A4BEAE2D1387A4E7A852FBFC519012A32D92CDB5E39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor bruteratel

Malware Config

Signatures

Family: Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
backdoor bruteratel

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_30da59942962c06a219d79797bb0e021_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-07_30da59942962c06a219d79797bb0e021_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 74.4MB

2026-08-07_30da59942962c06a219d79797bb0e021_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 5fbf916dc3841f3b5e4e8851cf729202
SHA256 ee66d13719eed8b23637e39f0638d085abf86e51cf6f250950bb2720ddb09fe2
MD5 30da59942962c06a219d79797bb0e021
SHA1 d94804b18286c9493dc0140125a57158215574ae
SHA512 3bc51784d6fafed4948a5eacbd501cc7cb5913c50aaf74e1c48bf6a025d6af031fb8c7fd75cbb650e54c635cbacb17154d3db417c6543151aa8c8b8929743849
SSDEEP 1572864:7V5xzLMjfiSVQplVsiX/kXlqBsXIhKnrigPKn1au:7LxzUfiSgrjnzZnJ
TLSH
T1D10801C675D052ECC7D2C134D24A4BEAE2D1387A4E7A852FBFC519012A32D92CDB5E39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4153404

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

GetActiveProcessorCount DuplicateHandle CreateThread GetProcAddress ReadFile GetFileInformationByHandleEx GetTempPathW SetFilePointerEx GetFileTime FindFirstFileW FindNextFileW FindClose SetFilePointer CreateWaitableTimerW GetModuleHandleA MultiByteToWideChar GlobalLock GlobalUnlock SetHandleInformation GetStdHandle CreatePipe Beep ExitProcess CreateProcessW GetFileSizeEx GetThreadContext SetThreadContext GlobalAlloc GlobalFree WideCharToMultiByte GetLocaleInfoA LoadLibraryA FreeLibrary QueryPerformanceCounter GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleA WriteFile GetDynamicTimeZoneInformation GetConsoleMode PeekNamedPipe DeleteFileW SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread LoadLibraryExW RtlUnwind RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer GetCurrentThreadId GetOverlappedResult CreateFileW DeviceIoControl CancelIo GetProcessHeap GetDriveTypeW HeapAlloc QueryPerformanceFrequency HeapFree GetSystemFirmwareTable CreateIoCompletionPort FormatMessageA TlsFree TlsGetValue SleepEx DeleteCriticalSection LocalFree QueueUserAPC CloseHandle Process32FirstW TlsAlloc Sleep GetCurrentThread SetEvent Process32NextW GetLastError CreateEventW CreateToolhelp32Snapshot PostQueuedCompletionStatus WaitForSingleObject GetQueuedCompletionStatus LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForMultipleObjects GetCurrentProcess EnterCriticalSection InitializeCriticalSectionEx WakeAllConditionVariable WakeConditionVariable SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetLastError TlsSetValue SetWaitableTimer SetEndOfFile WriteConsoleW HeapReAlloc GetCurrentProcessId InitializeSRWLock GetSystemDirectoryW AreFileApisANSI GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW GetExitCodeThread WaitForSingleObjectEx GetTickCount64 SleepConditionVariableSRW TryAcquireSRWLockExclusive GetLocaleInfoEx RaiseException SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode LoadLibraryW ConvertThreadToFiberEx SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW ConvertFiberToThread GetACP GetEnvironmentVariableW CreateFiberEx DeleteFiber SwitchToFiber GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualFree VirtualProtect GetSystemTimeAsFileTime GetModuleHandleW GetFileType GetModuleHandleExW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation HeapQueryInformation HeapSize RtlAddFunctionTable GetModuleFileNameW TerminateThread GetSystemDirectoryA ReleaseSRWLockExclusive

user32

GetProcessWindowStation ClientToScreen GetCapture GetUserObjectInformationW GetKeyState GetMessageExtraInfo ScreenToClient DisplayConfigGetDeviceInfo GetDisplayConfigBufferSizes QueryDisplayConfig FindWindowA GetWindowThreadProcessId wsprintfA MessageBoxW GetAsyncKeyState SetWindowDisplayAffinity SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent

advapi32

SetSecurityInfo RegOpenKeyExW RegCloseKey DeregisterEventSource RegisterEventSourceW ReportEventW RegSetValueExW CloseServiceHandle OpenSCManagerW ControlService OpenServiceW SetEntriesInAclA AllocateAndInitializeSid RegEnumKeyExW RegSetValueExA FreeSid RegOpenKeyExA RegQueryValueExW RegDeleteValueW RegEnumValueW GetSecurityInfo RegOpenKeyW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegSetKeyValueW RegDeleteTreeW RegCreateKeyW RegGetValueW RegCreateKeyExW

shell32

ShellExecuteW ShellExecuteExW

ole32

StringFromGUID2 CoInitializeEx CLSIDFromString CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeSecurity

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

ws2_32

WSAStartup WSACleanup WSAGetLastError ioctlsocket htons htonl getsockopt WSARecv connect WSASocketW WSAStringToAddressW WSASetLastError ntohl select WSASend closesocket ntohs gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname recv send socket shutdown setsockopt

bcrypt

BCryptGenRandom

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiOpenDevRegKey

ncrypt

NCryptFreeObject NCryptGetProperty NCryptOpenStorageProvider

ntdll

NtQuerySystemInformation RtlInitUnicodeString RtlFreeUnicodeString RtlInitAnsiString RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlAnsiStringToUnicodeString

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse

imm32

ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow ImmGetContext

d3dcompiler_43

D3DCompile

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.4rW_R

Size

60.0MB

Virtual Size

60.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_30da59942962c06a219d79797bb0e021_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

d3dx11_43

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

bcrypt

setupapi

ncrypt

ntdll

winhttp

imm32

d3dcompiler_43

generic