2026-08-12_ad6094658fd66e48130f28813fef7fea_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_ad6094658fd66e48130f28813fef7fea_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 6.7MB
Sample260813-apfevaxgra
SHA256 bb602219246c3d7ee7051dd3a91f94aea01a15390928206d5b49c5b7d0484cbc
MD5 ad6094658fd66e48130f28813fef7fea
SHA1 2d36cd137a6fd9784cbe501fca263422f17a7f5a
SHA512 fad878036d5d26367319cbf8400ba728b768cf178bd61f278643c57212bfdc6c80ad5ed71bb0daf9a117620ede125808cb172dfd4a8c54286d1b741b1ac08276
SSDEEP 49152:6GtlqAAVwASOrp4Ym6LXuT7opiANoEi59xc+fJmCr6DIFO1qAVQst1AT7n88MzXO:X76OEYt0DzxWMDQ+E+zI
TLSH
T147669D7DA67C00D9D4AAC1BDC6866213D772B85953B097DF0A608AF60F67BE05E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_ad6094658fd66e48130f28813fef7fea_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-12_ad6094658fd66e48130f28813fef7fea_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 6.7MB

2026-08-12_ad6094658fd66e48130f28813fef7fea_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 947b03212828420aab5bd15ee56aa074
SHA256 bb602219246c3d7ee7051dd3a91f94aea01a15390928206d5b49c5b7d0484cbc
MD5 ad6094658fd66e48130f28813fef7fea
SHA1 2d36cd137a6fd9784cbe501fca263422f17a7f5a
SHA512 fad878036d5d26367319cbf8400ba728b768cf178bd61f278643c57212bfdc6c80ad5ed71bb0daf9a117620ede125808cb172dfd4a8c54286d1b741b1ac08276
SSDEEP 49152:6GtlqAAVwASOrp4Ym6LXuT7opiANoEi59xc+fJmCr6DIFO1qAVQst1AT7n88MzXO:X76OEYt0DzxWMDQ+E+zI
TLSH
T147669D7DA67C00D9D4AAC1BDC6866213D772B85953B097DF0A608AF60F67BE05E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4696680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Lucky-Windows-Vanilla\proxy\x64\Release\Lucky Proxy.pdb

ws2_32

getservbyname recvfrom htons WSASetLastError getservbyport ntohl inet_addr ntohs inet_pton getnameinfo WSASocketW getpeername sendto getaddrinfo send recv WSASendTo WSARecvFrom WSAGetLastError WSACleanup WSAStartup gethostbyname gethostbyaddr socket shutdown setsockopt select listen inet_ntoa getsockopt getsockname ioctlsocket connect closesocket WSAIoctl freeaddrinfo WSASocketA bind accept __WSAFDIsSet htonl

winmm

timeBeginPeriod timeGetTime

kernel32

FlushFileBuffers GetConsoleOutputCP SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue CreateFileW ReadFile WriteFile CloseHandle GetLastError GetFileSizeEx WaitNamedPipeW GetCurrentProcessId GetModuleFileNameW lstrlenW MultiByteToWideChar Sleep GetStdHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute CreateDirectoryA GetVolumeInformationA GetCurrentProcess OpenProcess GetWindowsDirectoryA ReadProcessMemory WriteProcessMemory SetConsoleCtrlHandler SetConsoleTitleA CreateToolhelp32Snapshot Process32FirstW Process32NextW FlsAlloc HeapFree HeapAlloc SetFilePointerEx GetTimeZoneInformation HeapReAlloc GetExitCodeProcess CreatePipe DeleteFileW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetCommandLineW GetCommandLineA HeapSize WriteConsoleW SetEndOfFile PeekNamedPipe TerminateProcess FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW CreateProcessW DuplicateHandle ExitProcess FreeLibraryAndExitThread GetFileType GetModuleHandleW GetProcAddress SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA FreeLibrary LoadLibraryA FormatMessageA GetModuleHandleExW VirtualProtect VirtualFree GetEnvironmentVariableW WideCharToMultiByte GetACP RtlVirtualUnwind InitializeCriticalSection ReleaseSemaphore WaitForSingleObject GetExitCodeThread CreateSemaphoreA GetSystemTime SystemTimeToFileTime SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime LoadLibraryW ConvertFiberToThread ConvertThreadToFiber RtlUnwind GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW FindClose FindFirstFileW FindNextFileW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetTickCount64 LocalFree GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI GetFileInformationByHandleEx InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx LoadLibraryExW CreateThread ExitThread

user32

GetUserObjectInformationW GetProcessWindowStation MessageBoxW GetKeyState GetAsyncKeyState

advapi32

RegCloseKey CryptGenRandom CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW AdjustTokenPrivileges RegQueryValueExA RegOpenKeyExA GetCurrentHwProfileA LookupPrivilegeValueA OpenProcessToken

urlmon

URLDownloadToFileA

crypt32

CertEnumCertificatesInStore CertFreeCertificateContext CertOpenSystemStoreW CertFindCertificateInStore CertCloseStore

Name

.text

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

71KB

Virtual Size

313KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

209KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_ad6094658fd66e48130f28813fef7fea_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

ws2_32

winmm

kernel32

user32

advapi32

urlmon

crypt32

generic