bruteratel | 2026-08-09_c2a2a92d2d52798a1b81f88e94a05f35_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_c2a2a92d2d52798a1b81f88e94a05f35_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 75.6MB
Sample260809-cghlcaybpg
SHA256 5e74c4bfc05c57a0a7bda538d33e4cdcfc4c037313edb22e2d67183da19d425e
MD5 c2a2a92d2d52798a1b81f88e94a05f35
SHA1 b22cc3f2abe8232203b7392c465a54fa7b752dcc
SHA512 60347e927fec18ec3f2f0696e9d627ce22a404d0cd66a07bc0b88a2fb4ce680a13f0f4e835a7ac0f3422be90d67bff775d78b80e0d2f6dc08b61d6b1f6a07907
SSDEEP 1572864:1N5x6LMjfiSVQYl/S+ihoKVsl91DBc/w2epE/n:1zx6UfiSvr9/kGpC
TLSH
T1BE0801C678D061ECC7D2C134D28A1BEAE2E578754F76452BBFC618022A32D91CEB5E35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor bruteratel

Malware Config

Signatures

Family: Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
backdoor bruteratel

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_c2a2a92d2d52798a1b81f88e94a05f35_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-09_c2a2a92d2d52798a1b81f88e94a05f35_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 75.6MB

2026-08-09_c2a2a92d2d52798a1b81f88e94a05f35_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 5fbf916dc3841f3b5e4e8851cf729202
SHA256 5e74c4bfc05c57a0a7bda538d33e4cdcfc4c037313edb22e2d67183da19d425e
MD5 c2a2a92d2d52798a1b81f88e94a05f35
SHA1 b22cc3f2abe8232203b7392c465a54fa7b752dcc
SHA512 60347e927fec18ec3f2f0696e9d627ce22a404d0cd66a07bc0b88a2fb4ce680a13f0f4e835a7ac0f3422be90d67bff775d78b80e0d2f6dc08b61d6b1f6a07907
SSDEEP 1572864:1N5x6LMjfiSVQYl/S+ihoKVsl91DBc/w2epE/n:1zx6UfiSvr9/kGpC
TLSH
T1BE0801C678D061ECC7D2C134D28A1BEAE2E578754F76452BBFC618022A32D91CEB5E35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4153404

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

GetActiveProcessorCount DuplicateHandle CreateThread GetProcAddress ReadFile GetFileInformationByHandleEx GetTempPathW SetFilePointerEx GetFileTime FindFirstFileW FindNextFileW FindClose SetFilePointer CreateWaitableTimerW GetModuleHandleA MultiByteToWideChar GlobalLock GlobalUnlock SetHandleInformation GetStdHandle CreatePipe Beep ExitProcess CreateProcessW GetFileSizeEx GetThreadContext SetThreadContext GlobalAlloc GlobalFree WideCharToMultiByte GetLocaleInfoA LoadLibraryA FreeLibrary QueryPerformanceCounter GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleA WriteFile GetDynamicTimeZoneInformation GetConsoleMode PeekNamedPipe DeleteFileW SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread LoadLibraryExW RtlUnwind RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer GetCurrentThreadId GetOverlappedResult CreateFileW DeviceIoControl CancelIo GetProcessHeap GetDriveTypeW HeapAlloc QueryPerformanceFrequency HeapFree GetSystemFirmwareTable CreateIoCompletionPort FormatMessageA TlsFree TlsGetValue SleepEx DeleteCriticalSection LocalFree QueueUserAPC CloseHandle Process32FirstW TlsAlloc Sleep GetCurrentThread SetEvent Process32NextW GetLastError CreateEventW CreateToolhelp32Snapshot PostQueuedCompletionStatus WaitForSingleObject GetQueuedCompletionStatus LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForMultipleObjects GetCurrentProcess EnterCriticalSection InitializeCriticalSectionEx WakeAllConditionVariable WakeConditionVariable SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetLastError TlsSetValue SetWaitableTimer SetEndOfFile WriteConsoleW HeapReAlloc GetCurrentProcessId InitializeSRWLock GetSystemDirectoryW AreFileApisANSI GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW GetExitCodeThread WaitForSingleObjectEx GetTickCount64 SleepConditionVariableSRW TryAcquireSRWLockExclusive GetLocaleInfoEx RaiseException SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode LoadLibraryW ConvertThreadToFiberEx SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW ConvertFiberToThread GetACP GetEnvironmentVariableW CreateFiberEx DeleteFiber SwitchToFiber GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualFree VirtualProtect GetSystemTimeAsFileTime GetModuleHandleW GetFileType GetModuleHandleExW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation HeapQueryInformation HeapSize RtlAddFunctionTable GetModuleFileNameW TerminateThread GetSystemDirectoryA ReleaseSRWLockExclusive

user32

GetProcessWindowStation ClientToScreen GetCapture GetUserObjectInformationW GetKeyState GetMessageExtraInfo ScreenToClient DisplayConfigGetDeviceInfo GetDisplayConfigBufferSizes QueryDisplayConfig FindWindowA GetWindowThreadProcessId wsprintfA MessageBoxW GetAsyncKeyState SetWindowDisplayAffinity SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent

advapi32

SetSecurityInfo RegOpenKeyExW RegCloseKey DeregisterEventSource RegisterEventSourceW ReportEventW RegSetValueExW CloseServiceHandle OpenSCManagerW ControlService OpenServiceW SetEntriesInAclA AllocateAndInitializeSid RegEnumKeyExW RegSetValueExA FreeSid RegOpenKeyExA RegQueryValueExW RegDeleteValueW RegEnumValueW GetSecurityInfo RegOpenKeyW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegSetKeyValueW RegDeleteTreeW RegCreateKeyW RegGetValueW RegCreateKeyExW

shell32

ShellExecuteW ShellExecuteExW

ole32

StringFromGUID2 CoInitializeEx CLSIDFromString CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeSecurity

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

ws2_32

WSAStartup WSACleanup WSAGetLastError ioctlsocket htons htonl getsockopt WSARecv connect WSASocketW WSAStringToAddressW WSASetLastError ntohl select WSASend closesocket ntohs gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname recv send socket shutdown setsockopt

bcrypt

BCryptGenRandom

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiOpenDevRegKey

ncrypt

NCryptFreeObject NCryptGetProperty NCryptOpenStorageProvider

ntdll

NtQuerySystemInformation RtlInitUnicodeString RtlFreeUnicodeString RtlInitAnsiString RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlAnsiStringToUnicodeString

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse

imm32

ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow ImmGetContext

d3dcompiler_43

D3DCompile

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.o0jN]

Size

61.2MB

Virtual Size

61.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_c2a2a92d2d52798a1b81f88e94a05f35_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

d3dx11_43

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

bcrypt

setupapi

ncrypt

ntdll

winhttp

imm32

d3dcompiler_43

generic