2026-08-25_c5c44e65eab6cc63aa9f9bc0654e288c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_c5c44e65eab6cc63aa9f9bc0654e288c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 82.1MB
Sample260826-marwjsbp91
SHA256 ded8401292f799cdceb84f538a9247cc23a9074ec6beef0c844e68667a83d18f
MD5 c5c44e65eab6cc63aa9f9bc0654e288c
SHA1 fb33f1406ddeca84c5a3b3281740fd96d252842a
SHA512 20182290e1fd7ebea89084dd086fe97ec124b6d7bc64dd24c2587a0f93bd583a3866ae76803925d07a2c5c1d9aed2ce986af45f8861d264df8c564b825de9c6f
SSDEEP 1572864:/15x2IMjfiSVQ53iQl7uAF/eXPu6IDa+i9rmvSNT:/rx25fiSxQlacePf0lvvk
TLSH
T1331801C679D051ECC7D18038D24E1BEAE2D178794EBA852BBFC619023A32D91CDB5E35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_c5c44e65eab6cc63aa9f9bc0654e288c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-25_c5c44e65eab6cc63aa9f9bc0654e288c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 82.1MB

2026-08-25_c5c44e65eab6cc63aa9f9bc0654e288c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 5fbf916dc3841f3b5e4e8851cf729202
SHA256 ded8401292f799cdceb84f538a9247cc23a9074ec6beef0c844e68667a83d18f
MD5 c5c44e65eab6cc63aa9f9bc0654e288c
SHA1 fb33f1406ddeca84c5a3b3281740fd96d252842a
SHA512 20182290e1fd7ebea89084dd086fe97ec124b6d7bc64dd24c2587a0f93bd583a3866ae76803925d07a2c5c1d9aed2ce986af45f8861d264df8c564b825de9c6f
SSDEEP 1572864:/15x2IMjfiSVQ53iQl7uAF/eXPu6IDa+i9rmvSNT:/rx25fiSxQlacePf0lvvk
TLSH
T1331801C679D051ECC7D18038D24E1BEAE2D178794EBA852BBFC619023A32D91CDB5E35
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4152748

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

GetActiveProcessorCount DuplicateHandle CreateThread GetProcAddress ReadFile GetFileInformationByHandleEx GetTempPathW SetFilePointerEx GetFileTime FindFirstFileW FindNextFileW FindClose SetFilePointer CreateWaitableTimerW GetModuleHandleA MultiByteToWideChar GlobalLock GlobalUnlock SetHandleInformation GetStdHandle CreatePipe Beep ExitProcess CreateProcessW GetFileSizeEx GetThreadContext SetThreadContext GlobalAlloc GlobalFree WideCharToMultiByte GetLocaleInfoA LoadLibraryA FreeLibrary QueryPerformanceCounter GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleA WriteFile GetDynamicTimeZoneInformation GetConsoleMode PeekNamedPipe DeleteFileW SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread LoadLibraryExW RtlUnwind RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer GetCurrentThreadId GetOverlappedResult CreateFileW DeviceIoControl CancelIo GetProcessHeap GetDriveTypeW HeapAlloc QueryPerformanceFrequency HeapFree GetSystemFirmwareTable CreateIoCompletionPort FormatMessageA TlsFree TlsGetValue SleepEx DeleteCriticalSection LocalFree QueueUserAPC CloseHandle Process32FirstW TlsAlloc Sleep GetCurrentThread SetEvent Process32NextW GetLastError CreateEventW CreateToolhelp32Snapshot PostQueuedCompletionStatus WaitForSingleObject GetQueuedCompletionStatus LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForMultipleObjects GetCurrentProcess EnterCriticalSection InitializeCriticalSectionEx WakeAllConditionVariable WakeConditionVariable SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetLastError TlsSetValue SetWaitableTimer SetEndOfFile WriteConsoleW HeapReAlloc GetCurrentProcessId InitializeSRWLock GetSystemDirectoryW AreFileApisANSI GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW GetExitCodeThread WaitForSingleObjectEx GetTickCount64 SleepConditionVariableSRW TryAcquireSRWLockExclusive GetLocaleInfoEx RaiseException SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode LoadLibraryW ConvertThreadToFiberEx SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW ConvertFiberToThread GetACP GetEnvironmentVariableW CreateFiberEx DeleteFiber SwitchToFiber GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualFree VirtualProtect GetSystemTimeAsFileTime GetModuleHandleW GetFileType GetModuleHandleExW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation HeapQueryInformation HeapSize RtlAddFunctionTable GetModuleFileNameW TerminateThread GetSystemDirectoryA ReleaseSRWLockExclusive

user32

GetProcessWindowStation ClientToScreen GetCapture GetUserObjectInformationW GetKeyState GetMessageExtraInfo ScreenToClient DisplayConfigGetDeviceInfo GetDisplayConfigBufferSizes QueryDisplayConfig FindWindowA GetWindowThreadProcessId wsprintfA MessageBoxW GetAsyncKeyState SetWindowDisplayAffinity SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent

advapi32

SetSecurityInfo RegOpenKeyExW RegCloseKey DeregisterEventSource RegisterEventSourceW ReportEventW RegSetValueExW CloseServiceHandle OpenSCManagerW ControlService OpenServiceW SetEntriesInAclA AllocateAndInitializeSid RegEnumKeyExW RegSetValueExA FreeSid RegOpenKeyExA RegQueryValueExW RegDeleteValueW RegEnumValueW GetSecurityInfo RegOpenKeyW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegSetKeyValueW RegDeleteTreeW RegCreateKeyW RegGetValueW RegCreateKeyExW

shell32

ShellExecuteW ShellExecuteExW

ole32

StringFromGUID2 CoInitializeEx CLSIDFromString CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeSecurity

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

ws2_32

WSAStartup WSACleanup WSAGetLastError ioctlsocket htons htonl getsockopt WSARecv connect WSASocketW WSAStringToAddressW WSASetLastError ntohl select WSASend closesocket ntohs gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname recv send socket shutdown setsockopt

bcrypt

BCryptGenRandom

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiOpenDevRegKey

ncrypt

NCryptFreeObject NCryptGetProperty NCryptOpenStorageProvider

ntdll

NtQuerySystemInformation RtlInitUnicodeString RtlFreeUnicodeString RtlInitAnsiString RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlAnsiStringToUnicodeString

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse

imm32

ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow ImmGetContext

d3dcompiler_43

D3DCompile

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

173KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.JsZ(F

Size

67.7MB

Virtual Size

67.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_c5c44e65eab6cc63aa9f9bc0654e288c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

d3dx11_43

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

bcrypt

setupapi

ncrypt

ntdll

winhttp

imm32

d3dcompiler_43

generic