2026-08-21_2cf3937581b81c60a871b44717ad0be6_blankgrabber_coinminer_glassworm_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_2cf3937581b81c60a871b44717ad0be6_blankgrabber_coinminer_glassworm_icedid_njrat_stealc
Size 1.3MB
Sample260822-vs48laxale
SHA256 91d1e94abe261c0077418ddbce60dcd744c679fd0b1799dc8fcaee51a836f7ca
MD5 2cf3937581b81c60a871b44717ad0be6
SHA1 973b11914bc23a38aef501f173395da97b01d8b7
SHA512 9cff26eb330da0c3fc1754ceff584fdaff558787f2b3eb07db6f7833c5b9082ef1492cab2d440992a767120915e3720860182d9db123b2892146d3fd021b613d
SSDEEP 24576:3GtlqdwdZr1k5Jj9rwkYOz+Cf6XHgERIDL/Zl2:3GtlqdwdZr1y9lYs+e+xRIHZc
TLSH
T176556C016BA601E8D8BBC53CCEB24667FB7178261730CBDF16A0965A1F37AD05E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-21_2cf3937581b81c60a871b44717ad0be6_blankgrabber_coinminer_glassworm_icedid_njrat_stealc

File Explorer

2026-08-21_2cf3937581b81c60a871b44717ad0be6_blankgrabber_coinminer_glassworm_icedid_njrat_stealc

.exe 1.3MB

2026-08-21_2cf3937581b81c60a871b44717ad0be6_blankgrabber_coinminer_glassworm_icedid_njrat_stealc

IMPHASH 141099fa9fd8c71b0d771ef818918762
SHA256 91d1e94abe261c0077418ddbce60dcd744c679fd0b1799dc8fcaee51a836f7ca
MD5 2cf3937581b81c60a871b44717ad0be6
SHA1 973b11914bc23a38aef501f173395da97b01d8b7
SHA512 9cff26eb330da0c3fc1754ceff584fdaff558787f2b3eb07db6f7833c5b9082ef1492cab2d440992a767120915e3720860182d9db123b2892146d3fd021b613d
SSDEEP 24576:3GtlqdwdZr1k5Jj9rwkYOz+Cf6XHgERIDL/Zl2:3GtlqdwdZr1y9lYs+e+xRIHZc
TLSH
T176556C016BA601E8D8BBC53CCEB24667FB7178261730CBDF16A0965A1F37AD05E39721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1d:be:83:95:41:57:63:5c:f2:60:6f:72:00:4b:a7:f4:99:e9:e6:50:90:1e:60:aa:bd:27:34:fc:96:50:95:85

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,L=Yokohama-shi,ST=Kanagawa-ken,C=JP

Chains

Aug 18, 2026

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,L=Yokohama-shi,ST=Kanagawa-ken,C=JP

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,L=Yokohama-shi,ST=Kanagawa-ken,C=JP

Serial Number

33:00:04:6f:39:0e:81:ae:ff:e8:8b:4d:cc:00:00:00:04:6f:39

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 16, 2026 - Aug 19, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:56:7e:8f:9d:58:08:8e:e9:60:00:00:00:00:00:56

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

674400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\FastCopy\x64\Obj\ReleaseFcp\fcp.pdb

kernel32

CreateDirectoryW GetFullPathNameW GetFileAttributesW GetUserDefaultLCID DeleteFileW MoveFileExW CopyFileW MoveFileW ReadFile GetVolumeInformationW CancelIo TlsSetValue SetLastError EnterCriticalSection FindNextFileW WriteFile GetDiskFreeSpaceW SetFileTime SetThreadPriority LeaveCriticalSection InitializeCriticalSection FindClose WaitForSingleObject CreateFileW GetCurrentThreadId SuspendThread ResumeThread SetFileAttributesW Sleep GetFileInformationByHandle FormatMessageW LocalFileTimeToFileTime GetLastError FileTimeToSystemTime GetCurrentThread TerminateThread TlsAlloc CloseHandle GetLocalTime GetOverlappedResult DeleteCriticalSection SystemTimeToFileTime TlsGetValue SystemTimeToTzSpecificLocalTime TlsFree CreateEventA GetTickCount GetDriveTypeW SetFilePointer SetEndOfFile FlushFileBuffers GetFileSizeEx BackupRead BackupSeek GetFileTime BackupWrite CreateHardLinkW SetFilePointerEx SetFileValidData FindFirstFileW CreateMutexA ReleaseMutex GetFileSize GetSystemTimeAsFileTime SetDllDirectoryW SetConsoleCtrlHandler SetPriorityClass GetCommandLineW SetSystemPowerState GetCurrentProcess GetThreadLocale CreatePipe DuplicateHandle GetModuleHandleA OpenProcess ProcessIdToSessionId TzSpecificLocalTimeToSystemTime GetCurrentProcessId SetThreadExecutionState GetSystemTime GetLongPathNameW GetFileAttributesExW CreateProcessW GetStdHandle SetConsoleMode GetConsoleMode WriteConsoleW GetTempPathW GetCurrentDirectoryW SetCurrentDirectoryW GetModuleFileNameW GetProcAddress FreeLibrary UnmapViewOfFile OpenMutexA CreateFileMappingA MapViewOfFile DeviceIoControl RemoveDirectoryW FindFirstChangeNotificationW GetVolumeNameForVolumeMountPointW FindCloseChangeNotification FindNextChangeNotification GetModuleHandleW GetEnvironmentVariableW HeapSize GetConsoleOutputCP GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetOEMCP GetACP IsValidCodePage SetStdHandle HeapReAlloc ReadConsoleInputW VirtualFree VirtualAlloc SetEvent GetVersionExA GetEnvironmentStringsW IsDebuggerPresent WriteConsoleA OutputDebugStringA AttachConsole GetConsoleProcessList OutputDebugStringW FreeConsole GetFileType AllocConsole SetThreadLocale FindFirstFileExW TerminateProcess GetSystemDirectoryW CreateToolhelp32Snapshot GetExitCodeThread Process32NextW GlobalAlloc Process32FirstW GlobalFree LoadLibraryW GetWindowsDirectoryW GlobalLock MultiByteToWideChar WideCharToMultiByte CreateMutexW GlobalMemoryStatusEx ExitProcess GetModuleFileNameA RtlCaptureStackBackTrace GetModuleHandleExA RaiseException K32GetModuleInformation CreateThread IsBadReadPtr SetUnhandledExceptionFilter SizeofResource FindResourceA LockResource LoadResource GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA LCMapStringEx InitializeCriticalSectionEx EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwindEx RtlPcToFileHeader InitializeCriticalSectionAndSpinCount LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetConsoleCP GetCommandLineA HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW

oleaut32

VariantClear SafeArrayCreateVector SafeArrayPutElement VariantInit SafeArrayGetUBound SafeArrayGetElement SafeArrayGetLBound SysFreeString SysAllocString

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

824KB

Virtual Size

823KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

230KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

376KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_2cf3937581b81c60a871b44717ad0be6_blankgrabber_coinminer_glassworm_icedid_njrat_stealc

PE Signature issue

kernel32

oleaut32

version

generic