2026-08-24_b771e39a87684c8cc6e3a9576091f76e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-24_b771e39a87684c8cc6e3a9576091f76e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 68.8MB
Sample260825-dncjcafg49
SHA256 6f3f9f7f58c08889320b568a9a4087d99ec614717eade5e9fd1d47ee7eba478d
MD5 b771e39a87684c8cc6e3a9576091f76e
SHA1 ab8821b26d0336bc6be2fd9fe4f9b90ae2f67db6
SHA512 a22cc7eaec61dd3d151b88958a4e5ea08558ff0233704167d14fef85899e095610c756218fbeee8b8971b5d300d245197c4ebcfbcd9729e46857d9eb63b1635b
SSDEEP 1572864:Qw5xJLMjfiSVQp/qLtUlkHhDwMDEaXeJGbYiJmA+:QYxJUfiSXVEKMGjmd
TLSH
T12BF701C675D161ECC3D2C238D28E1AEAE2E138754E7A866F7FC614022932D91CDB5E35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_b771e39a87684c8cc6e3a9576091f76e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-24_b771e39a87684c8cc6e3a9576091f76e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 68.8MB

2026-08-24_b771e39a87684c8cc6e3a9576091f76e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 5fbf916dc3841f3b5e4e8851cf729202
SHA256 6f3f9f7f58c08889320b568a9a4087d99ec614717eade5e9fd1d47ee7eba478d
MD5 b771e39a87684c8cc6e3a9576091f76e
SHA1 ab8821b26d0336bc6be2fd9fe4f9b90ae2f67db6
SHA512 a22cc7eaec61dd3d151b88958a4e5ea08558ff0233704167d14fef85899e095610c756218fbeee8b8971b5d300d245197c4ebcfbcd9729e46857d9eb63b1635b
SSDEEP 1572864:Qw5xJLMjfiSVQp/qLtUlkHhDwMDEaXeJGbYiJmA+:QYxJUfiSXVEKMGjmd
TLSH
T12BF701C675D161ECC3D2C238D28E1AEAE2E138754E7A866F7FC614022932D91CDB5E35
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4153404

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

GetActiveProcessorCount DuplicateHandle CreateThread GetProcAddress ReadFile GetFileInformationByHandleEx GetTempPathW SetFilePointerEx GetFileTime FindFirstFileW FindNextFileW FindClose SetFilePointer CreateWaitableTimerW GetModuleHandleA MultiByteToWideChar GlobalLock GlobalUnlock SetHandleInformation GetStdHandle CreatePipe Beep ExitProcess CreateProcessW GetFileSizeEx GetThreadContext SetThreadContext GlobalAlloc GlobalFree WideCharToMultiByte GetLocaleInfoA LoadLibraryA FreeLibrary QueryPerformanceCounter GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleA WriteFile GetDynamicTimeZoneInformation GetConsoleMode PeekNamedPipe DeleteFileW SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread LoadLibraryExW RtlUnwind RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer GetCurrentThreadId GetOverlappedResult CreateFileW DeviceIoControl CancelIo GetProcessHeap GetDriveTypeW HeapAlloc QueryPerformanceFrequency HeapFree GetSystemFirmwareTable CreateIoCompletionPort FormatMessageA TlsFree TlsGetValue SleepEx DeleteCriticalSection LocalFree QueueUserAPC CloseHandle Process32FirstW TlsAlloc Sleep GetCurrentThread SetEvent Process32NextW GetLastError CreateEventW CreateToolhelp32Snapshot PostQueuedCompletionStatus WaitForSingleObject GetQueuedCompletionStatus LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForMultipleObjects GetCurrentProcess EnterCriticalSection InitializeCriticalSectionEx WakeAllConditionVariable WakeConditionVariable SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetLastError TlsSetValue SetWaitableTimer SetEndOfFile WriteConsoleW HeapReAlloc GetCurrentProcessId InitializeSRWLock GetSystemDirectoryW AreFileApisANSI GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW GetExitCodeThread WaitForSingleObjectEx GetTickCount64 SleepConditionVariableSRW TryAcquireSRWLockExclusive GetLocaleInfoEx RaiseException SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode LoadLibraryW ConvertThreadToFiberEx SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW ConvertFiberToThread GetACP GetEnvironmentVariableW CreateFiberEx DeleteFiber SwitchToFiber GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualFree VirtualProtect GetSystemTimeAsFileTime GetModuleHandleW GetFileType GetModuleHandleExW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation HeapQueryInformation HeapSize RtlAddFunctionTable GetModuleFileNameW TerminateThread GetSystemDirectoryA ReleaseSRWLockExclusive

user32

GetProcessWindowStation ClientToScreen GetCapture GetUserObjectInformationW GetKeyState GetMessageExtraInfo ScreenToClient DisplayConfigGetDeviceInfo GetDisplayConfigBufferSizes QueryDisplayConfig FindWindowA GetWindowThreadProcessId wsprintfA MessageBoxW GetAsyncKeyState SetWindowDisplayAffinity SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent

advapi32

SetSecurityInfo RegOpenKeyExW RegCloseKey DeregisterEventSource RegisterEventSourceW ReportEventW RegSetValueExW CloseServiceHandle OpenSCManagerW ControlService OpenServiceW SetEntriesInAclA AllocateAndInitializeSid RegEnumKeyExW RegSetValueExA FreeSid RegOpenKeyExA RegQueryValueExW RegDeleteValueW RegEnumValueW GetSecurityInfo RegOpenKeyW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegSetKeyValueW RegDeleteTreeW RegCreateKeyW RegGetValueW RegCreateKeyExW

shell32

ShellExecuteW ShellExecuteExW

ole32

StringFromGUID2 CoInitializeEx CLSIDFromString CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeSecurity

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

ws2_32

WSAStartup WSACleanup WSAGetLastError ioctlsocket htons htonl getsockopt WSARecv connect WSASocketW WSAStringToAddressW WSASetLastError ntohl select WSASend closesocket ntohs gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname recv send socket shutdown setsockopt

bcrypt

BCryptGenRandom

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiOpenDevRegKey

ncrypt

NCryptFreeObject NCryptGetProperty NCryptOpenStorageProvider

ntdll

NtQuerySystemInformation RtlInitUnicodeString RtlFreeUnicodeString RtlInitAnsiString RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlAnsiStringToUnicodeString

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse

imm32

ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow ImmGetContext

d3dcompiler_43

D3DCompile

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.5WsXQ

Size

54.4MB

Virtual Size

54.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_b771e39a87684c8cc6e3a9576091f76e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

d3dx11_43

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

bcrypt

setupapi

ncrypt

ntdll

winhttp

imm32

d3dcompiler_43

generic