2026-10-12_b1e9a0d1c67910c0e890a3e270652042_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-12_b1e9a0d1c67910c0e890a3e270652042_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 9.5MB
Sample261013-2nhblavtex
SHA256 649544bfff67fa8ed4d0253f72ec3ddb70659ecf99b02646ab02cd03c70f39f8
MD5 b1e9a0d1c67910c0e890a3e270652042
SHA1 86ff95b65f26f80c99b5efccad642faecb49704a
SHA512 ef68c813e5ca2fa497447423af5a3a7b45fe739b7f683df768b7ee18e99913917aea308015cf85f5dc321417bbab54f2e5c2a78e5e2612c0aa427ce7d58c35f8
SSDEEP 196608:hUjaDsPxr+DHg18nqlTXiBSdbVQBWGTJsVQBWG:GGmxroE8nqlTABxJB
TLSH
T131A67D39629901E4C0BFD3BF8B064133DAB2745483F785DB0591596A4F2BAEC7E39E21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-12_b1e9a0d1c67910c0e890a3e270652042_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-12_b1e9a0d1c67910c0e890a3e270652042_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 9.5MB

2026-10-12_b1e9a0d1c67910c0e890a3e270652042_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 26f421948661104dc8b423b1cdc5eff3
SHA256 649544bfff67fa8ed4d0253f72ec3ddb70659ecf99b02646ab02cd03c70f39f8
MD5 b1e9a0d1c67910c0e890a3e270652042
SHA1 86ff95b65f26f80c99b5efccad642faecb49704a
SHA512 ef68c813e5ca2fa497447423af5a3a7b45fe739b7f683df768b7ee18e99913917aea308015cf85f5dc321417bbab54f2e5c2a78e5e2612c0aa427ce7d58c35f8
SSDEEP 196608:hUjaDsPxr+DHg18nqlTXiBSdbVQBWGTJsVQBWG:GGmxroE8nqlTABxJB
TLSH
T131A67D39629901E4C0BFD3BF8B064133DAB2745483F785DB0591596A4F2BAEC7E39E21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4671352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Projects\fortect.com\fortect.engine\engine\Release\x64\MainService.pdb

wtsapi32

WTSEnumerateSessionsW WTSQuerySessionInformationW WTSQueryUserToken WTSFreeMemory

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

ws2_32

recv socket gethostbyname send WSAStartup WSAGetLastError WSAIoctl shutdown ntohs listen inet_ntoa inet_addr htons getsockopt getsockname getpeername ioctlsocket connect closesocket bind accept __WSAFDIsSet select setsockopt

advapi32

ChangeServiceConfig2W OpenServiceW StartServiceW QueryServiceStatusEx ControlService ChangeServiceConfigW CreateServiceW QueryServiceStatus DeleteService RegGetValueW RegEnumKeyExW RegEnumValueW RegDeleteValueW RegQueryInfoKeyW CreateProcessAsUserW ConvertStringSidToSidW EqualSid RegCreateKeyExW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW SetServiceStatus CloseServiceHandle SetSecurityDescriptorDacl SetSecurityDescriptorOwner CryptEncrypt CreateWellKnownSid CryptDecrypt InitializeSecurityDescriptor CryptSetKeyParam CryptGetHashParam OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW RegOpenKeyExW RegCloseKey ImpersonateLoggedOnUser RevertToSelf GetTokenInformation IsValidSid GetSidSubAuthority GetSidSubAuthorityCount LookupAccountNameW ConvertSidToStringSidW GetUserNameA RegOpenKeyExA CryptAcquireContextA RegQueryValueExA RegSetValueExW CryptAcquireContextW CryptSetHashParam CryptCreateHash CryptDestroyHash CryptSignHashA CryptReleaseContext CryptGetProvParam CryptGetUserKey CryptGenRandom CryptDestroyKey CryptExportKey CryptImportKey CryptHashData SetSecurityDescriptorGroup GetUserNameW ReadEventLogW OpenEventLogW CloseEventLog SetFileSecurityW ConvertStringSecurityDescriptorToSecurityDescriptorW IsValidAcl IsValidSecurityDescriptor GetFileSecurityW SetEntriesInAclW RegDeleteKeyExW OpenSCManagerW

shlwapi

PathRemoveFileSpecW PathFindFileNameW wnsprintfW StrCmpIW

user32

ExitWindowsEx GetIconInfo CreateIconIndirect GetSystemMetrics GetDC ReleaseDC LoadImageW DestroyIcon FindWindowExW GetWindowThreadProcessId wsprintfW PostMessageW

wintrust

WinVerifyTrust WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData

oleaut32

SysAllocStringByteLen SysStringByteLen SysFreeString VariantInit VariantClear SysAllocStringLen SysStringLen SysAllocString

ole32

StringFromGUID2 CoCreateInstance StgIsStorageFile CoInitializeEx CoUninitialize CoTaskMemFree StgOpenStorage CoInitializeSecurity CoSetProxyBlanket

iphlpapi

GetTcpTable2

shell32

SHChangeNotify SHCreateItemFromParsingName SHGetSpecialFolderPathW ExtractIconExW

sqlite

sqlite3_prepare16 sqlite3_finalize sqlite3_changes sqlite3_last_insert_rowid sqlite3_column_int sqlite3_errmsg sqlite3_bind_int sqlite3_step sqlite3_open16 sqlite3_close sqlite3_bind_text16 sqlite3_column_text16

rstrtmgr

RmStartSession RmRegisterResources RmEndSession RmGetList

dxgi

CreateDXGIFactory

winhttp

WinHttpSendRequest WinHttpSetTimeouts WinHttpOpen WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpReadData WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryDataAvailable

setupapi

SetupDiBuildDriverInfoList CM_Locate_DevNodeW SetupDiSetSelectedDriverW SetupDiEnumDriverInfoW SetupDiGetDeviceInstallParamsW SetupDiDestroyDriverInfoList CM_Reenumerate_DevNode SetupCopyOEMInfW SetupDiOpenDeviceInfoW SetupVerifyInfFileW SetupDiSetDeviceInstallParamsW CM_Get_DevNode_Status SetupFindFirstLineW SetupOpenInfFileW SetupGetStringFieldW SetupCloseInfFile SetupDiGetDeviceInstanceIdW SetupDiClassGuidsFromNameW SetupGetInfDriverStoreLocationW SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupSetNonInteractiveMode

wininet

InternetSetOptionW InternetOpenW InternetCrackUrlW InternetCloseHandle InternetConnectW HttpOpenRequestW HttpSendRequestW InternetQueryDataAvailable InternetReadFile InternetGetConnectedState

ntdll

RtlUnwind VerSetConditionMask RtlUnwindEx

crypt32

CryptBinaryToStringA CertGetNameStringW CryptStringToBinaryA

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

newdev

UpdateDriverForPlugAndPlayDevicesW DiInstallDevice

msi

ord70

wlanapi

WlanCloseHandle WlanRegisterNotification WlanOpenHandle WlanFreeMemory WlanQueryInterface

dbghelp

MiniDumpWriteDump

kernel32

FlsAlloc GetFileType GetStdHandle HeapReAlloc IsValidCodePage GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCommandLineA SystemTimeToTzSpecificLocalTime OutputDebugStringW GetStartupInfoW IsDebuggerPresent InitializeSListHead UnhandledExceptionFilter ReadConsoleW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork SetFilePointerEx FreeLibraryWhenCallbackReturns InitializeCriticalSectionAndSpinCount WriteConsoleW TlsAlloc TlsGetValue TlsSetValue TlsFree WakeAllConditionVariable RaiseException GetConsoleMode RtlPcToFileHeader GetFileInformationByHandleEx GetConsoleOutputCP AreFileApisANSI SetFileInformationByHandle FindFirstFileExW GetLocaleInfoEx IsProcessorFeaturePresent InitOnceBeginInitialize ExitThread InitOnceComplete FlushFileBuffers HeapSize GetExitCodeThread EnumSystemLocalesW WaitForSingleObjectEx SleepConditionVariableSRW AcquireSRWLockShared ReleaseSRWLockShared GetStringTypeW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive PeekNamedPipe CreatePipe SetHandleInformation GetFileAttributesExW GetUserDefaultLCID GetCurrentDirectoryW GetFileInformationByHandle IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue GetTickCount64 Sleep GetTickCount GetLastError DeleteFileW WaitForSingleObject GetExitCodeProcess K32EmptyWorkingSet OpenProcess GlobalMemoryStatusEx CloseHandle MoveFileW CopyFileW ReleaseSemaphore ReleaseMutex QueueUserWorkItem CreateEventW SetEvent GetCurrentProcess CreateMutexW GetFileAttributesW CreateThread SetUnhandledExceptionFilter FindFirstFileW DeviceIoControl FindClose CreateFileW GetFileTime LocalFree FormatMessageW LocalAlloc TerminateProcess WaitForMultipleObjects CreateSemaphoreW TerminateThread ReadFile WriteFile InitializeCriticalSectionEx GetProcAddress LoadLibraryW FreeLibrary GetDriveTypeW QueryDosDeviceW SetStdHandle GetCurrentProcessId DuplicateHandle LoadLibraryExW GetModuleFileNameW WTSGetActiveConsoleSessionId GetCommandLineW FindNextFileW GetCurrentDirectoryA CompareFileTime GetSystemTime GetLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CreateDirectoryW GetFullPathNameW RemoveDirectoryW SetFileAttributesW SetFilePointer GetTempPathW MoveFileExW GetSystemTimeAsFileTime FormatMessageA GetComputerNameW GetACP GetOEMCP QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId GetFileSize SetEndOfFile SetFileTime LocalFileTimeToFileTime LoadLibraryA GetVersionExA CreateSemaphoreA WideCharToMultiByte SetLastError VerifyVersionInfoW GetModuleHandleW GetNativeSystemInfo GetVersionExW GetProductInfo GetSystemInfo QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateProcessW ResumeThread ExitProcess OpenThread SuspendThread Thread32First Thread32Next GetProcessTimes DecodePointer HeapAlloc GetProcessHeap HeapFree GetThreadId MultiByteToWideChar GetSystemDirectoryW GetFileSizeEx ResetEvent GetLongPathNameW GetShortPathNameW GlobalAlloc GlobalFree ExpandEnvironmentStringsW GetPhysicallyInstalledSystemMemory GetFinalPathNameByHandleW FreeLibraryAndExitThread

rpcrt4

RpcStringFreeW UuidToStringW UuidCreate

vssapi

CreateVssBackupComponentsInternal VssFreeSnapshotPropertiesInternal

gdi32

GetDIBits CreateBitmap DeleteObject GetBitmapBits GetObjectW

Name

.text

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

373KB

Virtual Size

578KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

202KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

598KB

Virtual Size

598KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-12_b1e9a0d1c67910c0e890a3e270652042_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

wtsapi32

userenv

ws2_32

advapi32

shlwapi

user32

wintrust

oleaut32

ole32

iphlpapi

shell32

sqlite

rstrtmgr

dxgi

winhttp

setupapi

wininet

ntdll

crypt32

version

newdev

msi

wlanapi

dbghelp

kernel32

rpcrt4

vssapi

gdi32

generic