2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

General

Target
2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 7.6MB
Sample260929-2cdh9swbrc
SHA256 a445e5adafe1a743b83acbabe4b09c9d8c2310907779951a292fb158ca19a155
MD5 7275556e97f1106e434388efd01d5c8c
SHA1 e060d79efa525b9f06fc8fd8c006b6673dd6fa28
SHA512 01a1628680a877a33314bfaaa67b49aab8b934ef181a941737f0fd4e66c66d9f3f7e1ad16e6413c78db0a0d01e7a2aa234826006ae79538741443957b4763235
SSDEEP 98304:y5NKLwriZVdCdbgnkWxSmvT96Jdgx+smeMS+M4FHXWJTW+M4FHX:YNK8rSTCdUZxzTUJdU9Nr4cJS4
TLSH
T145869E99AAA510EDC07B8278C1929223FAF17C042335ABFB05E096796F73DF60D79714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 7.6MB

2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 7e9e299b29c17a5744a46d398ab576c3
SHA256 a445e5adafe1a743b83acbabe4b09c9d8c2310907779951a292fb158ca19a155
MD5 7275556e97f1106e434388efd01d5c8c
SHA1 e060d79efa525b9f06fc8fd8c006b6673dd6fa28
SHA512 01a1628680a877a33314bfaaa67b49aab8b934ef181a941737f0fd4e66c66d9f3f7e1ad16e6413c78db0a0d01e7a2aa234826006ae79538741443957b4763235
SSDEEP 98304:y5NKLwriZVdCdbgnkWxSmvT96Jdgx+smeMS+M4FHXWJTW+M4FHX:YNK8rSTCdUZxzTUJdU9Nr4cJS4
TLSH
T145869E99AAA510EDC07B8278C1929223FAF17C042335ABFB05E096796F73DF60D79714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4079104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ssr64.pdb

ws2_32

WSACleanup

kernel32

WaitForSingleObject CreateFileW GetCurrentThreadId ReleaseMutex UnmapViewOfFile GetLastError SetFileInformationByHandle GetCurrentThread DeleteFileW CloseHandle GetSystemInfo GetFileSize GetCurrentProcessId WideCharToMultiByte CreateFileMappingW MapViewOfFile GetFileInformationByHandle LocalFree Sleep AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetDiskFreeSpaceW OutputDebugStringA VirtualUnlock LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW GetFileAttributesW GetVersionExW HeapValidate HeapSize MultiByteToWideChar GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA FindClose LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile VirtualLock CreateFileMappingA MoveFileExW LockFileEx DeleteCriticalSection GetProcessHeap SystemTimeToFileTime FreeLibrary GetSystemTimeAsFileTime GetSystemTime FormatMessageA QueryPerformanceCounter GetTickCount FlushFileBuffers GetModuleHandleExW InitializeSRWLock TlsSetValue ReleaseSRWLockExclusive AcquireSRWLockExclusive TlsAlloc ReleaseSRWLockShared AcquireSRWLockShared TlsGetValue TlsFree GetEnvironmentVariableW VirtualProtect VirtualFree GetStdHandle GetFileType RtlVirtualUnwind SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetExitCodeThread GetACP FindNextFileW SetConsoleMode ReadConsoleA GetConsoleMode ReadConsoleW SystemTimeToTzSpecificLocalTime CreateMutexW SetFilePointer GetFinalPathNameByHandleW WriteFile GetFullPathNameW SetLastError FindFirstFileW ReadFile VerSetConditionMask VerifyVersionInfoA GetModuleHandleW GetProcAddress GetCurrentProcess FileTimeToSystemTime GetModuleFileNameW GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetConsoleOutputCP GetTimeZoneInformation GetFileSizeEx SetFilePointerEx GetCurrentDirectoryW FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW HeapReAlloc PeekNamedPipe GetDriveTypeW FreeLibraryAndExitThread RaiseException VirtualQuery LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW TryAcquireSRWLockExclusive InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlUnwindEx RtlPcToFileHeader InitializeCriticalSectionAndSpinCount LoadLibraryExW SetConsoleCtrlHandler ExitProcess CreateThread ExitThread

advapi32

DeregisterEventSource RegisterEventSourceW ReportEventW CryptDestroyKey CryptGetUserKey CryptAcquireContextW CryptEnumProvidersW CryptDecrypt CryptExportKey CryptCreateHash CryptSetHashParam CryptDestroyHash CryptSignHashW CryptGetProvParam CryptReleaseContext LookupPrivilegeValueW GetSecurityDescriptorSacl AdjustTokenPrivileges GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorControl GetSecurityDescriptorOwner IsValidSecurityDescriptor SetSecurityInfo SetSecurityDescriptorControl GetSecurityInfo RegCloseKey RegQueryInfoKeyW RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW GetSecurityDescriptorLength OpenProcessToken OpenThreadToken GetTokenInformation

bcrypt

BCryptGenRandom

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

157KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_7275556e97f1106e434388efd01d5c8c_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

ws2_32

kernel32

advapi32

bcrypt

generic