2026-09-29_cabbad9924145150052164727b5cdac3_amadey_coinminer_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_cabbad9924145150052164727b5cdac3_amadey_coinminer_glassworm_icedid_njrat_vidar
Size 3.4MB
Sample260930-t3tdeadb39
SHA256 62dcc1187c48200d2393feac2fef2ff841ad5c0edeb2ae756d54f04aaf6efab9
MD5 cabbad9924145150052164727b5cdac3
SHA1 2ac923bb80ca9d679c299eef37a776a31f0adc49
SHA512 3143583197a308558633e28f01a4fec79b3b2debe34d35dfae8acdf1354ee7e7e651aefec8df81db5eadea5df1679ec54d1f02c19812f21f994915dce71e1f4b
SSDEEP 49152:dDOOqxekIwZbn005yZL8BFi0fXpn3pL/+9hBZhOh5PSZNPigdyPpQul+Lupy0YQS:6dn5et+CWQu3pyGLm
TLSH
T184F5AE16A7A801E8EDB7C23C89528503E7B2B81917729BDF06A4567A1F337F15E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_cabbad9924145150052164727b5cdac3_amadey_coinminer_glassworm_icedid_njrat_vidar

File Explorer

2026-09-29_cabbad9924145150052164727b5cdac3_amadey_coinminer_glassworm_icedid_njrat_vidar

.exe 3.4MB

2026-09-29_cabbad9924145150052164727b5cdac3_amadey_coinminer_glassworm_icedid_njrat_vidar

IMPHASH f74866a8f79f1a22ee681605c0bcd49d
SHA256 62dcc1187c48200d2393feac2fef2ff841ad5c0edeb2ae756d54f04aaf6efab9
MD5 cabbad9924145150052164727b5cdac3
SHA1 2ac923bb80ca9d679c299eef37a776a31f0adc49
SHA512 3143583197a308558633e28f01a4fec79b3b2debe34d35dfae8acdf1354ee7e7e651aefec8df81db5eadea5df1679ec54d1f02c19812f21f994915dce71e1f4b
SSDEEP 49152:dDOOqxekIwZbn005yZL8BFi0fXpn3pL/+9hBZhOh5PSZNPigdyPpQul+Lupy0YQS:6dn5et+CWQu3pyGLm
TLSH
T184F5AE16A7A801E8EDB7C23C89528503E7B2B81917729BDF06A4567A1F337F15E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1633240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\jenkins\workspace\N_MBVpnTunnel\bin\x64\Release\MBVpnTunnelService.pdb

ws2_32

inet_ntop InetPtonW WSAStartup WSACleanup recv closesocket WSAGetLastError WSASetLastError send

crypt32

CertFreeCertificateContext CertFindCertificateInStore CryptMsgClose CryptQueryObject CertGetNameStringW CertOpenStore CertCloseStore CertGetCertificateContextProperty CertEnumCertificatesInStore CryptMsgGetParam CryptDecodeObjectEx CryptDecodeObject CertDuplicateCertificateContext

kernel32

FileTimeToSystemTime GetModuleFileNameW GetCurrentProcess GetWindowsDirectoryW GetLongPathNameW QueryDosDeviceW GetFileInformationByHandle SetFilePointer GetFileSizeEx GetLogicalDriveStringsW CreateProcessW GetExitCodeProcess GetCurrentThread GetFileSize lstrcmpA GetFileAttributesW GetFileAttributesExW CreateDirectoryW RemoveDirectoryW SetFileAttributesW DeleteFileW FormatMessageW GlobalAlloc GlobalFree ExpandEnvironmentStringsW LocalAlloc OutputDebugStringW GetCurrentThreadId SetEndOfFile FindNextFileW GetModuleHandleA GetStdHandle GetCurrentDirectoryW GetSystemTime ResetEvent ReleaseMutex CreateMutexW TerminateProcess GetStartupInfoW GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetEnvironmentVariableW SetEnvironmentVariableW SystemTimeToFileTime DeleteFiber GetFileType QueryPerformanceCounter ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFullPathNameW HeapReAlloc GetLocalTime GetTickCount GetTimeZoneInformation LocalFree GetSystemInfo VerifyVersionInfoW VerSetConditionMask GetVersionExW CopyFileW MoveFileExW MultiByteToWideChar WideCharToMultiByte CloseThreadpoolCleanupGroup CloseThreadpool CloseThreadpoolWork CloseThreadpoolCleanupGroupMembers SubmitThreadpoolWork CreateThreadpoolWork CreateNamedPipeW WaitForSingleObject SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum CreateThreadpoolCleanupGroup CreateThreadpool ConnectNamedPipe WriteFile ReadFile DisconnectNamedPipe FlushFileBuffers WaitForMultipleObjects GetOverlappedResult CancelIoEx SetLastError SetEvent CreateEventW HeapFree GetProcessHeap HeapAlloc MapViewOfFile OpenFileMappingW GetProcessTimes OpenProcess UnmapViewOfFile GetCurrentProcessId CloseHandle DecodePointer GetModuleHandleW DeleteCriticalSection InitializeCriticalSectionEx RaiseException EnterCriticalSection LeaveCriticalSection SwitchToThread Sleep GetProcAddress LoadLibraryW FreeLibrary FindClose FindFirstFileW GetLastError GetSystemDirectoryW CreateFileW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale SetFilePointerEx GetConsoleCP GetCommandLineW GetCommandLineA SetConsoleCtrlHandler ExitProcess PeekNamedPipe GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RtlPcToFileHeader InterlockedPushEntrySList RtlUnwindEx IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead WaitForSingleObjectEx GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer GetStringTypeW SetThreadPriority SystemTimeToTzSpecificLocalTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize WriteConsoleW InitializeCriticalSectionAndSpinCount

user32

GetUserObjectInformationW MessageBoxW GetProcessWindowStation

advapi32

CryptAcquireContextW RegCloseKey RegQueryValueExW RegEnumKeyExW IsTextUnicode OpenProcessToken CryptCreateHash CryptReleaseContext CryptDestroyHash OpenThreadToken AllocateAndInitializeSid FreeSid CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey ReportEventW RegisterEventSourceW DeregisterEventSource CreateWellKnownSid GetSidSubAuthority GetSidSubAuthorityCount AreAllAccessesGranted MapGenericMask ConvertStringSidToSidW ConvertSidToStringSidW AdjustTokenPrivileges LookupPrivilegeValueW RegUnLoadKeyW RegSetValueExW RegSaveKeyW RegRestoreKeyW RegQueryInfoKeyW RegLoadAppKeyW RegLoadKeyW RegEnumValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW TreeSetNamedSecurityInfoW SetSecurityInfo GetSecurityInfo SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW DeleteAce GetExplicitEntriesFromAclW RegOpenKeyExW

shell32

SHGetFolderPathW

oleaut32

VariantClear

mpr

WNetGetConnectionW

netapi32

NetApiBufferFree NetWkstaGetInfo

sfc

SfcIsFileProtected

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

psapi

GetProcessImageFileNameW

bcrypt

BCryptVerifySignature BCryptGetProperty BCryptDestroyKey BCryptFinishHash BCryptImportKeyPair BCryptHashData BCryptCreateHash BCryptGenRandom BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyHash

wintrust

CryptCATAdminReleaseContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext WinVerifyTrust CryptCATAdminReleaseCatalogContext CryptCATAdminAcquireContext

authz

AuthzFreeResourceManager AuthzInitializeContextFromSid AuthzAccessCheck AuthzInitializeResourceManager AuthzFreeContext

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

917KB

Virtual Size

916KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

596KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_cabbad9924145150052164727b5cdac3_amadey_coinminer_glassworm_icedid_njrat_vidar

ws2_32

crypt32

kernel32

user32

advapi32

shell32

oleaut32

mpr

netapi32

sfc

version

psapi

bcrypt

wintrust

authz

generic