2026-10-26_e3165c06f4d9fc611f038729491a00b8_coinminer_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_e3165c06f4d9fc611f038729491a00b8_coinminer_glassworm_icedid_njrat
Size 13.4MB
Sample261027-e2s9pabt7j
SHA256 02df33c3be95dbc782eb807e1c0578b64b9719f95b00fb282659fcadb422bbc9
MD5 e3165c06f4d9fc611f038729491a00b8
SHA1 3ffa06900b5b2c787656bd0cdf6282151d0affdc
SHA512 fb86df92218d5752422f07424cba9802c5f9a65982c7637104003a56ab2133778bc85545ba286d92913ac040d4dc5b645904d4d56a2c67ea165688a1cabd52de
SSDEEP 49152:CqCn6FFhpOpkYSXpkaNREI2ZVEjAGaOaalHiS7MJPE6d9dTIzg+AZEZ/q0ayli7r:X10iaFwW0Q3T
TLSH
T1A6E6C447FB7640C2D4BAC0399252E62BFCB1389AC375A7DB97415B561B22BE0AD3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_e3165c06f4d9fc611f038729491a00b8_coinminer_glassworm_icedid_njrat

File Explorer

2026-10-26_e3165c06f4d9fc611f038729491a00b8_coinminer_glassworm_icedid_njrat

.exe 13.4MB

2026-10-26_e3165c06f4d9fc611f038729491a00b8_coinminer_glassworm_icedid_njrat

IMPHASH 83a3331aa7800be3775515c718ac8a42
SHA256 02df33c3be95dbc782eb807e1c0578b64b9719f95b00fb282659fcadb422bbc9
MD5 e3165c06f4d9fc611f038729491a00b8
SHA1 3ffa06900b5b2c787656bd0cdf6282151d0affdc
SHA512 fb86df92218d5752422f07424cba9802c5f9a65982c7637104003a56ab2133778bc85545ba286d92913ac040d4dc5b645904d4d56a2c67ea165688a1cabd52de
SSDEEP 49152:CqCn6FFhpOpkYSXpkaNREI2ZVEjAGaOaalHiS7MJPE6d9dTIzg+AZEZ/q0ayli7r:X10iaFwW0Q3T
TLSH
T1A6E6C447FB7640C2D4BAC0399252E62BFCB1389AC375A7DB97415B561B22BE0AD3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

85671

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\source\repo\engine\trunk\db\norm\converter\build\windows_x86_64_Debug\bin\Debug\norm-converter.pdb

ws2_32

WSAIoctl WSASetLastError htonl setsockopt getsockopt select shutdown ntohl ioctlsocket getnameinfo inet_pton freeaddrinfo getaddrinfo WSAGetLastError WSACleanup WSAStartup socket send recv connect getsockname closesocket

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetFileSizeEx IsDebuggerPresent CloseHandle GetLastError GetCurrentProcess FlushProcessWriteBuffers GetSystemInfo VirtualAlloc VirtualFree VirtualAllocEx VirtualFreeEx GetLargePageMinimum GetProcessWorkingSetSize SetProcessWorkingSetSizeEx VirtualLock FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary SystemTimeToFileTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx LocalFree GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile SetFilePointerEx GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId InitOnceExecuteOnce FindClose FindFirstFileW FindNextFileW ReleaseMutex CreateMutexA TerminateProcess MoveFileExA GetModuleFileNameA GetStdHandle GetFileType GetConsoleMode SetConsoleMode CompareStringW GetTimeZoneInformation SetStdHandle IsValidCodePage EnumSystemLocalesW OutputDebugStringW RemoveDirectoryW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber SetConsoleCtrlHandler HeapQueryInformation GetCurrentThread UnhandledExceptionFilter GetConsoleOutputCP ReadConsoleW GetCommandLineW GetCommandLineA FileTimeToSystemTime SleepEx SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW WriteConsoleW FreeLibraryAndExitThread ResumeThread RemoveDirectoryA CreateDirectoryA LoadLibraryExA SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP QueryPerformanceFrequency GetSystemTimePreciseAsFileTime SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileAttributesW SetFileInformationByHandle SetFileTime CreateFile2 DeviceIoControl GetModuleHandleW CreateDirectoryExW CopyFile2 MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive LoadLibraryExW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead VirtualQuery InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetModuleHandleExW ExitProcess IsProcessorFeaturePresent CreateThread ExitThread GetACP

advapi32

CryptAcquireContextA LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken CryptGenRandom GetUserNameA

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress

bcrypt

BCryptGenRandom

secur32

FreeCredentialsHandle InitializeSecurityContextA FreeContextBuffer DeleteSecurityContext AcquireCredentialsHandleA

ntdll

RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlUnwindEx RtlCaptureContext RtlVirtualUnwind RtlUnwind RtlPcToFileHeader

shell32

SHGetFolderPathA

Name

.text

Size

9.9MB

Virtual Size

9.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

443KB

Virtual Size

466KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

551KB

Virtual Size

550KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_e3165c06f4d9fc611f038729491a00b8_coinminer_glassworm_icedid_njrat

ws2_32

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

bcrypt

secur32

ntdll

shell32

generic