2026-10-19_74455a5f6eed90be247afa404e62b9a5_coinminer_glassworm_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_74455a5f6eed90be247afa404e62b9a5_coinminer_glassworm_icedid_njrat_stealc
Size 5.3MB
Sample261020-twmbhsstd1
SHA256 7d6fa679075466c24cf569937ce24c187623a4809600c27b5e0a7d7757a0309a
MD5 74455a5f6eed90be247afa404e62b9a5
SHA1 1e082dc898a8ee1d25c8435e89a47188018956c6
SHA512 16cb6c2c29f8d097f5cbb125d9daa1a17aebb67b352c6c70264fc33889c5290d564147bedb8442fd7d99014700510bbfe3ac60653b120957974ed2369b0ff731
SSDEEP 49152:9GtlqA4VwASO0dOx7cWPUFRQ0z9LA/r2suYp5QHjIy1MlTgfoQivilAa6GFLRC8K:kQ02pFyqgfoHVmPFBaBcmvF+M
TLSH
T1D1469DB9A6BC00D9D87AC1BDC2865223E7B2B85517F057CF1A6486F90F23AD41E7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_74455a5f6eed90be247afa404e62b9a5_coinminer_glassworm_icedid_njrat_stealc

File Explorer

2026-10-19_74455a5f6eed90be247afa404e62b9a5_coinminer_glassworm_icedid_njrat_stealc

.exe 5.3MB

2026-10-19_74455a5f6eed90be247afa404e62b9a5_coinminer_glassworm_icedid_njrat_stealc

IMPHASH 7e42c6545ed114b6e9a0548db6a6abe6
SHA256 7d6fa679075466c24cf569937ce24c187623a4809600c27b5e0a7d7757a0309a
MD5 74455a5f6eed90be247afa404e62b9a5
SHA1 1e082dc898a8ee1d25c8435e89a47188018956c6
SHA512 16cb6c2c29f8d097f5cbb125d9daa1a17aebb67b352c6c70264fc33889c5290d564147bedb8442fd7d99014700510bbfe3ac60653b120957974ed2369b0ff731
SSDEEP 49152:9GtlqA4VwASO0dOx7cWPUFRQ0z9LA/r2suYp5QHjIy1MlTgfoQivilAa6GFLRC8K:kQ02pFyqgfoHVmPFBaBcmvF+M
TLSH
T1D1469DB9A6BC00D9D87AC1BDC2865223E7B2B85517F057CF1A6486F90F23AD41E7E740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3723496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSASocketW inet_pton getaddrinfo WSAStartup getpeername getsockname send socket ntohs connect closesocket getsockopt WSAPoll freeaddrinfo ioctlsocket WSAGetLastError getnameinfo setsockopt WSACleanup listen bind shutdown recv WSASetLastError WSASocketA WSAIoctl sendto recvfrom select getservbyname getservbyport gethostbyname gethostbyaddr inet_ntoa inet_addr htons htonl accept

iphlpapi

GetAdaptersInfo

crypt32

CertFindCertificateInStore CertCreateCertificateContext CertFreeCertificateContext CertOpenSystemStoreW CertEnumCertificatesInStore CertCloseStore CertFreeCertificateChain CertVerifyCertificateChainPolicy CertGetCertificateChain

kernel32

SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead UnhandledExceptionFilter GetStringTypeW GetCPInfo VirtualFree VirtualAlloc VirtualUnlock MultiByteToWideChar GetLastError GetSystemInfo VirtualLock GetFileSizeEx CloseHandle DeviceIoControl CreateFileA GetStdHandle SetConsoleMode GetConsoleMode GetSystemFirmwareTable HeapAlloc GetProcessHeap HeapFree Sleep GetCurrentProcess TerminateProcess CreateFileW GetLocalTime SetConsoleCtrlHandler SetConsoleTextAttribute GetCurrentThreadId WriteConsoleW SetConsoleOutputCP ReadFile WriteFile GetModuleFileNameA LoadLibraryExA CreateToolhelp32Snapshot GetTickCount64 Process32NextW LoadLibraryA Process32FirstW Module32FirstW Beep GetProcAddress FreeLibrary SleepEx Module32NextW SystemTimeToFileTime VirtualProtect ExitProcess SetProcessMitigationPolicy WideCharToMultiByte OpenProcess GetCurrentProcessId LocalFree EnterCriticalSection LeaveCriticalSection RtlUnwindEx HeapSize HeapReAlloc DecodePointer DeleteCriticalSection CreateThread AddVectoredExceptionHandler IsDebuggerPresent SetLastError OutputDebugStringW RaiseException VerSetConditionMask VerifyVersionInfoW CheckRemoteDebuggerPresent DebugBreak RemoveVectoredExceptionHandler RtlCaptureContext GetThreadContext GetModuleHandleW K32GetModuleInformation GetModuleHandleExW DuplicateHandle K32GetProcessImageFileNameW QueryPerformanceFrequency QueryPerformanceCounter EnumSystemFirmwareTables GlobalGetAtomNameA GetBinaryTypeW GetEnvironmentVariableW GetWriteWatch ResetWriteWatch HeapQueryInformation ReadProcessMemory LoadLibraryExW CreateMutexA GetFileType RtlVirtualUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA FormatMessageA GetSystemTimeAsFileTime SwitchToFiber DeleteFiber CreateFiber GetACP InitializeCriticalSection ReleaseSemaphore WaitForSingleObject GetExitCodeThread CreateSemaphoreA GetSystemTime ConvertFiberToThread ConvertThreadToFiber RtlUnwind FindClose FindFirstFileW FindNextFileW ReadConsoleA ReadConsoleW EncodePointer LCMapStringEx GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFullPathNameW ExitThread FreeLibraryAndExitThread GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation SetStdHandle GetConsoleOutputCP SetFilePointerEx FlushFileBuffers IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetEndOfFile InitializeCriticalSectionEx LoadLibraryW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx WakeAllConditionVariable WaitForSingleObjectEx SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceBeginInitialize InitOnceComplete

user32

FindWindowA MessageBoxW GetUserObjectInformationW GetProcessWindowStation CloseWindow

advapi32

CryptGenRandom ReportEventW RegisterEventSourceW DeregisterEventSource LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken CryptAcquireContextW CryptReleaseContext RegCloseKey RegOpenKeyExA

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

ntdll

RtlPcToFileHeader RtlLookupFunctionEntry

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

162KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_74455a5f6eed90be247afa404e62b9a5_coinminer_glassworm_icedid_njrat_stealc

ws2_32

iphlpapi

crypt32

kernel32

user32

advapi32

shell32

ole32

ntdll

generic