2026-10-01_8dce46e7ccac6b501ab10cf02665a85e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_8dce46e7ccac6b501ab10cf02665a85e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 8.2MB
Sample261002-k6lcjaef79
SHA256 1d5b2584db736fce25002ca6f744f8e9713a87290bb9a847dc0ac6db5839d824
MD5 8dce46e7ccac6b501ab10cf02665a85e
SHA1 18d22e2e13e4444b967ea87f25e537f403aaeabf
SHA512 1cc3679b2c38383264b5deb2d390fb670cad029447638218d5c06d7df22490816c2328b27b611ef91568fc345f761e2d69d1b7e1666133bf7cd5066f61f4a8a9
SSDEEP 98304:qt2UWkbsi74s1Q2BjotBaNrfII7KDuKc/F+7yE:q+Q38IQ2BjoKNrfII7Yct4
TLSH
T18C86BF6EE6BD00D5D86695BCC2965217F332B01917B047DB6BA845FA0F63AD80F3BB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_8dce46e7ccac6b501ab10cf02665a85e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-01_8dce46e7ccac6b501ab10cf02665a85e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 8.2MB

2026-10-01_8dce46e7ccac6b501ab10cf02665a85e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 61923a6d106be88b47f561354e0abc5e
SHA256 1d5b2584db736fce25002ca6f744f8e9713a87290bb9a847dc0ac6db5839d824
MD5 8dce46e7ccac6b501ab10cf02665a85e
SHA1 18d22e2e13e4444b967ea87f25e537f403aaeabf
SHA512 1cc3679b2c38383264b5deb2d390fb670cad029447638218d5c06d7df22490816c2328b27b611ef91568fc345f761e2d69d1b7e1666133bf7cd5066f61f4a8a9
SSDEEP 98304:qt2UWkbsi74s1Q2BjotBaNrfII7KDuKc/F+7yE:q+Q38IQ2BjoKNrfII7Yct4
TLSH
T18C86BF6EE6BD00D5D86695BCC2965217F332B01917B047DB6BA845FA0F63AD80F3BB01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5219148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

NtQuerySystemInformation RtlAdjustPrivilege RtlUnwind RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx

dbghelp

SymGetOptions SymLoadModuleEx SymGetTypeInfo SymUnloadModule64 SymGetTypeFromName SymSrvGetFileIndexInfo MiniDumpWriteDump SymInitialize SymFromName SymSetSearchPath SymGetSearchPath SymCleanup SymSetOptions

bcrypt

BCryptCloseAlgorithmProvider BCryptGetProperty BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptDestroyHash BCryptEncrypt BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey

crypt32

CertFindCertificateInStore CertOpenStore CertDuplicateCertificateContext CertVerifyCertificateChainPolicy CryptBinaryToStringA CryptStringToBinaryA CertCreateCertificateContext CertGetCertificateChain CertFreeCertificateContext CertOpenSystemStoreW CertEnumCertificatesInStore CertCloseStore CertFreeCertificateChain CertGetCertificateContextProperty CryptUnprotectData CryptProtectData

iphlpapi

GetAdaptersAddresses

ole32

CoInitializeEx CoCreateInstance CoSetProxyBlanket CoCreateGuid CreateStreamOnHGlobal CoUninitialize

oleaut32

VariantInit SysFreeString SysStringByteLen SysAllocStringByteLen SysAllocString VariantClear

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpSetOption

gdiplus

GdipGetImageEncodersSize GdiplusShutdown GdiplusStartup GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdipSaveImageToStream GdipCloneImage GdipAlloc

kernel32

CopyFileW AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FlsGetValue FlsAlloc HeapFree HeapAlloc SetConsoleCtrlHandler GetConsoleOutputCP SetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread GetModuleFileNameA FindFirstFileA SetConsoleTitleA FindNextFileA FindClose GetCommandLineA MoveFileExA DeleteFileA AllocConsole GetCurrentProcess TerminateProcess CloseHandle GetModuleHandleW MultiByteToWideChar ReadFile SetHandleInformation SetLastError CreatePipe PeekNamedPipe GetFirmwareEnvironmentVariableA WaitForSingleObject GetModuleHandleA GetLastError GetSystemDirectoryA GetProcAddress CreateProcessA GetTickCount GetExitCodeProcess CreateDirectoryW GetEnvironmentVariableW OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW DeleteFileW Process32FirstW CreateProcessW WideCharToMultiByte GetLogicalDrives MoveFileA GetSystemDirectoryW GetFileAttributesA SetFileAttributesA GetCurrentThread QueryPerformanceFrequency GetThreadContext QueryPerformanceCounter IsDebuggerPresent CheckRemoteDebuggerPresent GetTickCount64 RaiseFailFastException ExitProcess LocalFree CreateDirectoryA GetNativeSystemInfo GetComputerNameW GlobalMemoryStatusEx SetErrorMode GetEnvironmentVariableA GetCurrentThreadId GetTempPathA CreateFileA GetCurrentProcessId SetUnhandledExceptionFilter GetFileSizeEx GetModuleFileNameW CreateFileW SetFilePointerEx MoveFileExW VirtualFree VirtualAlloc VirtualLock Thread32First LoadLibraryA SetFileAttributesW GlobalAlloc GlobalUnlock GlobalLock GlobalFree FreeLibrary GetLocaleInfoA InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualProtect SwitchToFiber DeleteFiber CreateFiberEx GetFileType GetSystemTime SystemTimeToFileTime FindFirstFileW FindNextFileW GetModuleHandleExW FormatMessageA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetACP GetStdHandle ConvertFiberToThread ConvertThreadToFiberEx GetSystemTimeAsFileTime RtlVirtualUnwind LoadLibraryW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW LCMapStringEx FindFirstFileExW GetCurrentDirectoryW GetLocaleInfoEx SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive InitOnceBeginInitialize InitOnceComplete CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RaiseException WaitForSingleObjectEx FlsSetValue FlsFree GetStartupInfoW InitializeSListHead InitializeCriticalSectionAndSpinCount LoadLibraryExW CreateThread ExitThread CompareStringW GetFileInformationByHandleEx InitializeCriticalSectionEx LCMapStringW EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers Thread32Next GetLocalTime HeapReAlloc GetTimeZoneInformation IsValidCodePage GetOEMCP GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW HeapSize SetEndOfFile WriteFile UnhandledExceptionFilter

user32

SetCursor GetCursorPos ClientToScreen LoadCursorA SetCursorPos GetProcessWindowStation UpdateWindow PostQuitMessage GetClientRect TranslateMessage PeekMessageW DispatchMessageW ShowWindow RegisterClassExW UnregisterClassW GetSystemMetrics ScreenToClient CreateWindowExW DestroyWindow PostMessageW DefWindowProcW EnumWindows GetWindowTextA GetMonitorInfoA EnumDisplayMonitors GetUserObjectInformationW MessageBoxW MessageBoxA GetClipboardData GetAsyncKeyState OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout

gdi32

CreateDCA SelectObject DeleteDC DeleteObject CreateCompatibleDC CreateCompatibleBitmap BitBlt

advapi32

CryptGenRandom ReportEventW RegisterEventSourceW DeregisterEventSource GetUserNameW RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExA RegCreateKeyExA RegSetValueExA OpenProcessToken RegOpenKeyExA GetTokenInformation CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW CryptReleaseContext CryptAcquireContextW

shell32

SHGetFolderPathA ShellExecuteW

ws2_32

htonl bind accept WSAIoctl select WSACleanup closesocket shutdown WSASocketW inet_pton getaddrinfo WSAStartup getpeername getsockname send socket ntohs connect recv listen WSASocketA WSASetLastError recvfrom sendto htons inet_addr setsockopt inet_ntoa gethostbyaddr gethostbyname getservbyport getservbyname getsockopt WSAPoll freeaddrinfo ioctlsocket getnameinfo WSAGetLastError

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

79KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

217KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_8dce46e7ccac6b501ab10cf02665a85e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

d3d11

ntdll

dbghelp

bcrypt

crypt32

iphlpapi

ole32

oleaut32

winhttp

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ws2_32

imm32

d3dcompiler_47

generic