2026-08-08_cd2d01002e76d2259d4851cf613b2cfd_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_cd2d01002e76d2259d4851cf613b2cfd_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 4.1MB
Sample260808-c66dpsydqc
SHA256 9fab69aae6eaf0c8e3e1b8717d12a83e15ea6d35d5507164c631bbbe81997aee
MD5 cd2d01002e76d2259d4851cf613b2cfd
SHA1 4feda8f3b92933d4b703ccc364ef8766872d3919
SHA512 219c65e378d2305b87557a9cfb5f485608b8817f22bde2a73d067207ab4a674b0b1ef2cf19c4708b33b1740407b4a96168f0d8ffb4813b685a98efda9a699577
SSDEEP 49152:QdxGtlqWIU6i/hh75eTm76W0so4W+qQgWyspS1vkAl3vqqKisnaBc1mP/gQ20nxy:wd+/hhVDnSRp8aCwgQI
TLSH
T12516BE56B7A801F8D4B7C139C95B9A27D7F2B81513B09BDB02A0857A1F73AE05E3B701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_cd2d01002e76d2259d4851cf613b2cfd_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-08_cd2d01002e76d2259d4851cf613b2cfd_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 4.1MB

2026-08-08_cd2d01002e76d2259d4851cf613b2cfd_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH d455c17141d37b9334515f6ccb9b2c02
SHA256 9fab69aae6eaf0c8e3e1b8717d12a83e15ea6d35d5507164c631bbbe81997aee
MD5 cd2d01002e76d2259d4851cf613b2cfd
SHA1 4feda8f3b92933d4b703ccc364ef8766872d3919
SHA512 219c65e378d2305b87557a9cfb5f485608b8817f22bde2a73d067207ab4a674b0b1ef2cf19c4708b33b1740407b4a96168f0d8ffb4813b685a98efda9a699577
SSDEEP 49152:QdxGtlqWIU6i/hh75eTm76W0so4W+qQgWyspS1vkAl3vqqKisnaBc1mP/gQ20nxy:wd+/hhVDnSRp8aCwgQI
TLSH
T12516BE56B7A801F8D4B7C139C95B9A27D7F2B81513B09BDB02A0857A1F73AE05E3B701
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1538860

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Work\Loader\Hitme\KombatLauncher\bin\Release\KombatConquer.pdb

d3d9

Direct3DCreate9

kernel32

Sleep GetTickCount Process32First TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32Next ExitProcess CreateProcessW GetVolumeInformationA GetWindowsDirectoryA GetComputerNameExA GetComputerNameA SizeofResource LockResource WritePrivateProfileStringA LoadResource FindResourceW GetModuleHandleW GetPrivateProfileIntA GetPrivateProfileStringA RtlVirtualUnwind GetStdHandle GetEnvironmentVariableW GetFileType WriteFile SetLastError GetSystemTime SystemTimeToFileTime GetModuleFileNameW QueryPerformanceCounter FreeLibrary GetProcAddress IsDBCSLeadByte QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar GetLocalTime GetCurrentThreadId ReadConsoleA SetConsoleMode LoadLibraryW ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber WriteConsoleW SetEndOfFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapQueryInformation GetTimeZoneInformation SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect OutputDebugStringA CloseHandle CreateFileA GetFileSizeEx ReadFile CreateDirectoryA GetProcessHeap GetCurrentProcessId DeleteCriticalSection DecodePointer HeapAlloc HeapReAlloc GetLastError FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetCommandLineW GetCommandLineA DeleteFileW TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW LoadLibraryExW TlsFree HeapSize InitializeCriticalSectionEx HeapFree GetModuleFileNameA LocalFree TlsSetValue TlsGetValue WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW RtlUnwind FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileInformationByHandle SetFileTime AreFileApisANSI MoveFileExW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive RtlPcToFileHeader RaiseException GetTickCount64 EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW RtlUnwindEx InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount TlsAlloc

user32

MessageBoxW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos ScreenToClient ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen SetCursorPos EnumDisplaySettingsW GetUserObjectInformationW GetProcessWindowStation CreateWindowExW GetSystemMetrics RegisterClassExW DefWindowProcA LoadIconA PostQuitMessage UpdateWindow DispatchMessageA GetWindowRect DestroyWindow SetWindowPos UnregisterClassW ShowWindow TranslateMessage PeekMessageA MessageBoxA DefWindowProcW GetKeyState GetMessageExtraInfo LoadCursorA GetCapture

advapi32

CryptDecrypt CryptDestroyHash CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptReleaseContext CryptAcquireContextA ReportEventW RegisterEventSourceW DeregisterEventSource RegCloseKey RegQueryValueExA RegOpenKeyExA CryptAcquireContextW CryptEnumProvidersW CryptSignHashW CryptCreateHash

shell32

ShellExecuteW ShellExecuteA

urlmon

URLDownloadToFileA

ws2_32

inet_pton getaddrinfo WSAStartup WSACleanup inet_addr WSAGetLastError setsockopt freeaddrinfo htons recv connect socket send WSASetLastError closesocket

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

winhttp

WinHttpGetIEProxyConfigForCurrentUser

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

61KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_cd2d01002e76d2259d4851cf613b2cfd_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

d3d9

kernel32

user32

advapi32

shell32

urlmon

ws2_32

imm32

winhttp

crypt32

bcrypt

generic