2026-08-23_e6392f68cc8676516e1619871e999e08_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-23_e6392f68cc8676516e1619871e999e08_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 69.5MB
Sample260823-vs2sgattes
SHA256 97a319b091585f1ac9b14eea4260a465107726b023c22b8b18964b3c622f785d
MD5 e6392f68cc8676516e1619871e999e08
SHA1 71cdb56e816b963300ddb16f9c6b09a495cb4534
SHA512 1e3019d6c0b81bacc9698a514aa63eeb9eb7a0e68a676438059dc6440a5daa768645a5b8d8935e3dc5a7284681603eb282a4d38971ed4216ed2eaf0e4c19ad3d
SSDEEP 1572864:W2X5x1LMjfiSVQ0WZASUIs2KzGIAEDYA:Wcx1UfiS/Wg/Aq
TLSH
T166F701CB74D061DCC3D2C138C28E5AEAE2E178B54E7A452BAFC615022A32DD1DDB5E35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_e6392f68cc8676516e1619871e999e08_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-23_e6392f68cc8676516e1619871e999e08_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 69.5MB

2026-08-23_e6392f68cc8676516e1619871e999e08_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 5fbf916dc3841f3b5e4e8851cf729202
SHA256 97a319b091585f1ac9b14eea4260a465107726b023c22b8b18964b3c622f785d
MD5 e6392f68cc8676516e1619871e999e08
SHA1 71cdb56e816b963300ddb16f9c6b09a495cb4534
SHA512 1e3019d6c0b81bacc9698a514aa63eeb9eb7a0e68a676438059dc6440a5daa768645a5b8d8935e3dc5a7284681603eb282a4d38971ed4216ed2eaf0e4c19ad3d
SSDEEP 1572864:W2X5x1LMjfiSVQ0WZASUIs2KzGIAEDYA:Wcx1UfiS/Wg/Aq
TLSH
T166F701CB74D061DCC3D2C138C28E5AEAE2E178B54E7A452BAFC615022A32DD1DDB5E35
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4153404

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

GetActiveProcessorCount DuplicateHandle CreateThread GetProcAddress ReadFile GetFileInformationByHandleEx GetTempPathW SetFilePointerEx GetFileTime FindFirstFileW FindNextFileW FindClose SetFilePointer CreateWaitableTimerW GetModuleHandleA MultiByteToWideChar GlobalLock GlobalUnlock SetHandleInformation GetStdHandle CreatePipe Beep ExitProcess CreateProcessW GetFileSizeEx GetThreadContext SetThreadContext GlobalAlloc GlobalFree WideCharToMultiByte GetLocaleInfoA LoadLibraryA FreeLibrary QueryPerformanceCounter GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleA WriteFile GetDynamicTimeZoneInformation GetConsoleMode PeekNamedPipe DeleteFileW SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread LoadLibraryExW RtlUnwind RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer GetCurrentThreadId GetOverlappedResult CreateFileW DeviceIoControl CancelIo GetProcessHeap GetDriveTypeW HeapAlloc QueryPerformanceFrequency HeapFree GetSystemFirmwareTable CreateIoCompletionPort FormatMessageA TlsFree TlsGetValue SleepEx DeleteCriticalSection LocalFree QueueUserAPC CloseHandle Process32FirstW TlsAlloc Sleep GetCurrentThread SetEvent Process32NextW GetLastError CreateEventW CreateToolhelp32Snapshot PostQueuedCompletionStatus WaitForSingleObject GetQueuedCompletionStatus LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForMultipleObjects GetCurrentProcess EnterCriticalSection InitializeCriticalSectionEx WakeAllConditionVariable WakeConditionVariable SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetLastError TlsSetValue SetWaitableTimer SetEndOfFile WriteConsoleW HeapReAlloc GetCurrentProcessId InitializeSRWLock GetSystemDirectoryW AreFileApisANSI GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW GetExitCodeThread WaitForSingleObjectEx GetTickCount64 SleepConditionVariableSRW TryAcquireSRWLockExclusive GetLocaleInfoEx RaiseException SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode LoadLibraryW ConvertThreadToFiberEx SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW ConvertFiberToThread GetACP GetEnvironmentVariableW CreateFiberEx DeleteFiber SwitchToFiber GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualFree VirtualProtect GetSystemTimeAsFileTime GetModuleHandleW GetFileType GetModuleHandleExW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation HeapQueryInformation HeapSize RtlAddFunctionTable GetModuleFileNameW TerminateThread GetSystemDirectoryA ReleaseSRWLockExclusive

user32

GetProcessWindowStation ClientToScreen GetCapture GetUserObjectInformationW GetKeyState GetMessageExtraInfo ScreenToClient DisplayConfigGetDeviceInfo GetDisplayConfigBufferSizes QueryDisplayConfig FindWindowA GetWindowThreadProcessId wsprintfA MessageBoxW GetAsyncKeyState SetWindowDisplayAffinity SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent

advapi32

SetSecurityInfo RegOpenKeyExW RegCloseKey DeregisterEventSource RegisterEventSourceW ReportEventW RegSetValueExW CloseServiceHandle OpenSCManagerW ControlService OpenServiceW SetEntriesInAclA AllocateAndInitializeSid RegEnumKeyExW RegSetValueExA FreeSid RegOpenKeyExA RegQueryValueExW RegDeleteValueW RegEnumValueW GetSecurityInfo RegOpenKeyW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegSetKeyValueW RegDeleteTreeW RegCreateKeyW RegGetValueW RegCreateKeyExW

shell32

ShellExecuteW ShellExecuteExW

ole32

StringFromGUID2 CoInitializeEx CLSIDFromString CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeSecurity

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

ws2_32

WSAStartup WSACleanup WSAGetLastError ioctlsocket htons htonl getsockopt WSARecv connect WSASocketW WSAStringToAddressW WSASetLastError ntohl select WSASend closesocket ntohs gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname recv send socket shutdown setsockopt

bcrypt

BCryptGenRandom

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiOpenDevRegKey

ncrypt

NCryptFreeObject NCryptGetProperty NCryptOpenStorageProvider

ntdll

NtQuerySystemInformation RtlInitUnicodeString RtlFreeUnicodeString RtlInitAnsiString RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlAnsiStringToUnicodeString

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse

imm32

ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow ImmGetContext

d3dcompiler_43

D3DCompile

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Gv3qO

Size

55.1MB

Virtual Size

55.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_e6392f68cc8676516e1619871e999e08_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

d3dx11_43

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

bcrypt

setupapi

ncrypt

ntdll

winhttp

imm32

d3dcompiler_43

generic