2026-10-08_26280d4551a141cd5d4e3a5f78812ab7_coinminer_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-08_26280d4551a141cd5d4e3a5f78812ab7_coinminer_glassworm_icedid_njrat
Size 13.4MB
Sample261009-xlltsadh67
SHA256 d77448b7f550585dc5b47315baab7918054e8201beb8e1f26aa6d92a2fe41064
MD5 26280d4551a141cd5d4e3a5f78812ab7
SHA1 0d210d6f1ae319596aa60cfb037cbe250795bb32
SHA512 8356947ab13cb8a48cf40e0c7149e21fa7a3f606e4fbc57e31f47cef4637d157ad8a7b1d56e79811ac1c0cbff2bb441a916788e6355c8e48eba9b17d7d2dadde
SSDEEP 98304:iGFygg3Of26HtbudGVZY2+M7Lm/Qau3WZWuwwNUUrytPoWzcuHE+0T/HkLc7WrOt:F1gejHtiznW1XnU
TLSH
T1C1E6C447FB7640C2D4BAC0399652E62BFCB1389AC374A7DB97415B561B22BE0AD3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-08_26280d4551a141cd5d4e3a5f78812ab7_coinminer_glassworm_icedid_njrat

File Explorer

2026-10-08_26280d4551a141cd5d4e3a5f78812ab7_coinminer_glassworm_icedid_njrat

.exe 13.4MB

2026-10-08_26280d4551a141cd5d4e3a5f78812ab7_coinminer_glassworm_icedid_njrat

IMPHASH 7e7a7700aed52bccb233971730256d21
SHA256 d77448b7f550585dc5b47315baab7918054e8201beb8e1f26aa6d92a2fe41064
MD5 26280d4551a141cd5d4e3a5f78812ab7
SHA1 0d210d6f1ae319596aa60cfb037cbe250795bb32
SHA512 8356947ab13cb8a48cf40e0c7149e21fa7a3f606e4fbc57e31f47cef4637d157ad8a7b1d56e79811ac1c0cbff2bb441a916788e6355c8e48eba9b17d7d2dadde
SSDEEP 98304:iGFygg3Of26HtbudGVZY2+M7Lm/Qau3WZWuwwNUUrytPoWzcuHE+0T/HkLc7WrOt:F1gejHtiznW1XnU
TLSH
T1C1E6C447FB7640C2D4BAC0399652E62BFCB1389AC374A7DB97415B561B22BE0AD3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

85571

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\source\repo\engine\trunk\db\norm\converter\build\windows_x86_64_Debug\bin\Debug\norm-converter.pdb

ws2_32

WSAIoctl WSASetLastError htonl setsockopt getsockopt select shutdown ntohl ioctlsocket getnameinfo inet_pton freeaddrinfo getaddrinfo WSAGetLastError WSACleanup WSAStartup socket send recv connect getsockname closesocket

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetFileSizeEx IsDebuggerPresent CloseHandle GetLastError GetCurrentProcess FlushProcessWriteBuffers GetSystemInfo VirtualAlloc VirtualFree VirtualAllocEx VirtualFreeEx GetLargePageMinimum GetProcessWorkingSetSize SetProcessWorkingSetSizeEx VirtualLock FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary SystemTimeToFileTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx LocalFree GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile SetFilePointerEx GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId InitOnceExecuteOnce FindClose FindFirstFileW FindNextFileW ReleaseMutex CreateMutexA TerminateProcess MoveFileExA GetModuleFileNameA GetStdHandle GetFileType GetConsoleMode SetConsoleMode CompareStringW GetTimeZoneInformation SetStdHandle IsValidCodePage EnumSystemLocalesW OutputDebugStringW RemoveDirectoryW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber HeapQueryInformation GetCurrentThread UnhandledExceptionFilter GetConsoleOutputCP ReadConsoleW GetCommandLineW GetCommandLineA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime SleepEx PeekNamedPipe GetDriveTypeW WriteConsoleW FreeLibraryAndExitThread ResumeThread ExitThread RemoveDirectoryA CreateDirectoryA LoadLibraryExA SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP QueryPerformanceFrequency GetSystemTimePreciseAsFileTime SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileAttributesW SetFileInformationByHandle SetFileTime CreateFile2 DeviceIoControl GetModuleHandleW CreateDirectoryExW CopyFile2 MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive LoadLibraryExW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead VirtualQuery InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetModuleHandleExW ExitProcess SetConsoleCtrlHandler IsProcessorFeaturePresent CreateThread GetACP

advapi32

CryptAcquireContextA LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken CryptGenRandom GetUserNameA

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress

bcrypt

BCryptGenRandom

secur32

FreeCredentialsHandle InitializeSecurityContextA FreeContextBuffer DeleteSecurityContext AcquireCredentialsHandleA

ntdll

RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlUnwindEx RtlCaptureContext RtlVirtualUnwind RtlUnwind RtlPcToFileHeader

shell32

SHGetFolderPathA

Name

.text

Size

9.9MB

Virtual Size

9.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

443KB

Virtual Size

466KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

549KB

Virtual Size

548KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_26280d4551a141cd5d4e3a5f78812ab7_coinminer_glassworm_icedid_njrat

ws2_32

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

bcrypt

secur32

ntdll

shell32

generic