2026-09-28_fe2d3dba3532b2c996a484d63c7d9ec6_coinminer_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_fe2d3dba3532b2c996a484d63c7d9ec6_coinminer_glassworm_icedid_njrat_vidar
Size 5.0MB
Sample260928-zz5vxstfma
SHA256 6d08464dff8ccd6bf26b3f65d579bdeb5b846e286fa097f2fd9936aadcad16d8
MD5 fe2d3dba3532b2c996a484d63c7d9ec6
SHA1 4fb4bd9c0f2e9c8cb7f19e1518f5321e132b2de3
SHA512 630ae1e77d967dae27a7acb981736f2f636ea460701ab43127c01f889006103434dfd3d095fb63a130be15d6f21940aee7dd39119bb9a503d002060fce2c03f8
SSDEEP 49152:kiGtlqiVwASOBPTTy92GiJSN5yG/sROqFHuz5o6LKO8eTvjgzR325lfZvUjQPhO3:8P3shNAZXOe92xUMOHBlf7yJe8+mUk
TLSH
T1DF368DA9A6BC00D9D86AC1BCC2865227E771B81513B05BCF5A6446FA0F63FD42F7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_fe2d3dba3532b2c996a484d63c7d9ec6_coinminer_glassworm_icedid_njrat_vidar

File Explorer

2026-09-28_fe2d3dba3532b2c996a484d63c7d9ec6_coinminer_glassworm_icedid_njrat_vidar

.exe 5.0MB

2026-09-28_fe2d3dba3532b2c996a484d63c7d9ec6_coinminer_glassworm_icedid_njrat_vidar

IMPHASH 46c6bdf98949153ed47dd01694aa6edc
SHA256 6d08464dff8ccd6bf26b3f65d579bdeb5b846e286fa097f2fd9936aadcad16d8
MD5 fe2d3dba3532b2c996a484d63c7d9ec6
SHA1 4fb4bd9c0f2e9c8cb7f19e1518f5321e132b2de3
SHA512 630ae1e77d967dae27a7acb981736f2f636ea460701ab43127c01f889006103434dfd3d095fb63a130be15d6f21940aee7dd39119bb9a503d002060fce2c03f8
SSDEEP 49152:kiGtlqiVwASOBPTTy92GiJSN5yG/sROqFHuz5o6LKO8eTvjgzR325lfZvUjQPhO3:8P3shNAZXOe92xUMOHBlf7yJe8+mUk
TLSH
T1DF368DA9A6BC00D9D86AC1BCC2865227E771B81513B05BCF5A6446FA0F63FD42F7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3557476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertGetCertificateContextProperty CertOpenSystemStoreW CertOpenStore

shlwapi

PathFileExistsW

dbghelp

SymInitialize SymGetLineFromAddr64 SymFromAddr

ws2_32

shutdown ioctlsocket getservbyname getservbyport gethostbyname gethostbyaddr ntohs inet_ntoa inet_addr htons recvfrom getsockopt getpeername WSASetLastError WSASocketA WSACleanup WSAStartup setsockopt send recv listen htonl getsockname connect bind accept WSAIoctl WSAGetLastError select closesocket getaddrinfo socket freeaddrinfo sendto

kernel32

GetFileSizeEx FlushFileBuffers HeapReAlloc LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA GetModuleFileNameW SetConsoleCtrlHandler ExitProcess SetFilePointerEx InitOnceExecuteOnce SetLastError MultiByteToWideChar WideCharToMultiByte EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetEnvironmentVariableA DeleteCriticalSection GetCurrentProcess RtlCaptureStackBackTrace GetLastError OutputDebugStringA IsDebuggerPresent GetCurrentThreadId GetLocalTime GetCurrentProcessId CreateFileW GetSystemTimeAsFileTime QueryPerformanceCounter GetCurrentDirectoryW GetEnvironmentVariableW GetModuleHandleExW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualFree SwitchToFiber DeleteFiber CreateFiberEx FindFirstFileW FindNextFileW GetFileType GetSystemTime SystemTimeToFileTime GetSystemDirectoryA FreeLibrary GetProcAddress LoadLibraryA FormatMessageA CloseHandle InitializeCriticalSection ReleaseSemaphore WaitForSingleObject GetExitCodeThread CreateSemaphoreA GetACP GetStdHandle WriteFile GetModuleHandleW ConvertFiberToThread ConvertThreadToFiberEx LoadLibraryW RtlVirtualUnwind GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW FreeLibraryAndExitThread ExitThread CreateThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW SetFileAttributesW GetFileAttributesExW SetStdHandle GetFullPathNameW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW GetProcessHeap WriteConsoleW GetTimeZoneInformation HeapSize SetEndOfFile FindClose RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW RtlUnwindEx LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetConsoleOutputCP ReadFile

user32

GetProcessWindowStation CharUpperBuffW MessageBoxW GetUserObjectInformationW

shell32

SHGetKnownFolderPath SHCreateDirectoryExW

ole32

CoTaskMemFree

advapi32

CryptCreateHash RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash DeregisterEventSource CryptDecrypt CryptExportKey CryptGetUserKey

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_fe2d3dba3532b2c996a484d63c7d9ec6_coinminer_glassworm_icedid_njrat_vidar

crypt32

shlwapi

dbghelp

ws2_32

kernel32

user32

shell32

ole32

advapi32

generic