2026-11-02_cad7e1e288243825d784eb276dc5fdb3_coinminer_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_cad7e1e288243825d784eb276dc5fdb3_coinminer_glassworm_icedid_njrat
Size 13.5MB
Sample261102-2mppaafy2p
SHA256 a2fc5c0efae6a1a03b79a48bf1b8ccc5c0f5dcc429e1ffda95a7392e01826879
MD5 cad7e1e288243825d784eb276dc5fdb3
SHA1 dd0ba690535d57fdeb6dc8f3a387264ce1210afb
SHA512 3157edd6a3c4b7fc3eaf7d10858af7758abe6b236cd708151d9c471053f2fa14eda85ecdd900e93b09012042cebfe5259cd8092a20734d17e17cd7404882bba8
SSDEEP 49152:ApxXy7ADHK1R5vvGt4nAkqRH4d8ui+lr79Vr7XvWJiVMq28nTx4EHmZQi+zli7zf:ixK1H+ejLOUyAc75Iy
TLSH
T196E6C447FB7650C2D4BAC0399252E62BFCB1389AC375A7DB97415B461B22BE0AD3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_cad7e1e288243825d784eb276dc5fdb3_coinminer_glassworm_icedid_njrat

File Explorer

2026-11-02_cad7e1e288243825d784eb276dc5fdb3_coinminer_glassworm_icedid_njrat

.exe 13.5MB

2026-11-02_cad7e1e288243825d784eb276dc5fdb3_coinminer_glassworm_icedid_njrat

IMPHASH 83a3331aa7800be3775515c718ac8a42
SHA256 a2fc5c0efae6a1a03b79a48bf1b8ccc5c0f5dcc429e1ffda95a7392e01826879
MD5 cad7e1e288243825d784eb276dc5fdb3
SHA1 dd0ba690535d57fdeb6dc8f3a387264ce1210afb
SHA512 3157edd6a3c4b7fc3eaf7d10858af7758abe6b236cd708151d9c471053f2fa14eda85ecdd900e93b09012042cebfe5259cd8092a20734d17e17cd7404882bba8
SSDEEP 49152:ApxXy7ADHK1R5vvGt4nAkqRH4d8ui+lr79Vr7XvWJiVMq28nTx4EHmZQi+zli7zf:ixK1H+ejLOUyAc75Iy
TLSH
T196E6C447FB7650C2D4BAC0399252E62BFCB1389AC375A7DB97415B461B22BE0AD3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

86531

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\source\repo\engine\trunk\db\norm\converter\build\windows_x86_64_Debug\bin\Debug\norm-converter.pdb

ws2_32

WSAIoctl WSASetLastError htonl setsockopt getsockopt select shutdown ntohl ioctlsocket getnameinfo inet_pton freeaddrinfo getaddrinfo WSAGetLastError WSACleanup WSAStartup socket send recv connect getsockname closesocket

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetFileSizeEx IsDebuggerPresent CloseHandle GetLastError GetCurrentProcess FlushProcessWriteBuffers GetSystemInfo VirtualAlloc VirtualFree VirtualAllocEx VirtualFreeEx GetLargePageMinimum GetProcessWorkingSetSize SetProcessWorkingSetSizeEx VirtualLock FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary SystemTimeToFileTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx LocalFree GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile SetFilePointerEx GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId InitOnceExecuteOnce FindClose FindFirstFileW FindNextFileW ReleaseMutex CreateMutexA TerminateProcess MoveFileExA GetModuleFileNameA GetStdHandle GetFileType GetConsoleMode SetConsoleMode CompareStringW GetTimeZoneInformation SetStdHandle IsValidCodePage EnumSystemLocalesW OutputDebugStringW RemoveDirectoryW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber SetConsoleCtrlHandler HeapQueryInformation GetCurrentThread UnhandledExceptionFilter GetConsoleOutputCP ReadConsoleW GetCommandLineW GetCommandLineA FileTimeToSystemTime SleepEx SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW WriteConsoleW FreeLibraryAndExitThread ResumeThread RemoveDirectoryA CreateDirectoryA LoadLibraryExA SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP QueryPerformanceFrequency GetSystemTimePreciseAsFileTime SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileAttributesW SetFileInformationByHandle SetFileTime CreateFile2 DeviceIoControl GetModuleHandleW CreateDirectoryExW CopyFile2 MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive LoadLibraryExW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead VirtualQuery InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetModuleHandleExW ExitProcess IsProcessorFeaturePresent CreateThread ExitThread GetACP

advapi32

CryptAcquireContextA LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken CryptGenRandom GetUserNameA

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress

bcrypt

BCryptGenRandom

secur32

FreeCredentialsHandle InitializeSecurityContextA FreeContextBuffer DeleteSecurityContext AcquireCredentialsHandleA

ntdll

RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlUnwindEx RtlCaptureContext RtlVirtualUnwind RtlUnwind RtlPcToFileHeader

shell32

SHGetFolderPathA

Name

.text

Size

10.0MB

Virtual Size

10.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

443KB

Virtual Size

466KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

556KB

Virtual Size

556KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_cad7e1e288243825d784eb276dc5fdb3_coinminer_glassworm_icedid_njrat

ws2_32

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

bcrypt

secur32

ntdll

shell32

generic