2026-11-02_c31619bd09833f54c572fc3906c45432_coinminer_glassworm_hammertoss_hijackloader_icedid_luca-stealer_njrat_poet-rat_quasar-rat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_c31619bd09833f54c572fc3906c45432_coinminer_glassworm_hammertoss_hijackloader_icedid_luca-stealer_njrat_poet-rat_quasar-rat_stealc_vidar
Size 30.6MB
Sample261102-3fl59adx9v
SHA256 1858a40496a1f027d267ec1409c84f17df43f46619f6f2ff7d25dbef1ffca8a8
MD5 c31619bd09833f54c572fc3906c45432
SHA1 8aa693d8b5b7fb962e8fb394a5c9d3100d94ffb4
SHA512 35d4c162658d1e0d94e02ac449c5043d7e99c2573f37277a0e5f71ddf2313dbafce35d402931b2ba5e4878ff4cb93cef2664c7cfcfe89dfd69f23466c4c7c133
SSDEEP 393216:0SD2sm2Eyxq5RAGEJjwZBKfiJyI4MoIhprEBEdBbkkB43:0SqIpeZBKSgMnrrkEd
TLSH
T16067AD1473E89F26C5AF4F75A0F1062093B6B44A6B62D78F328C56FA1F53B905D213A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects encrypted or obfuscated .NET executables 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_DotNET_Encrypted

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_c31619bd09833f54c572fc3906c45432_coinminer_glassworm_hammertoss_hijackloader_icedid_luca-stealer_njrat_poet-rat_quasar-rat_stealc_vidar

File Explorer

2026-11-02_c31619bd09833f54c572fc3906c45432_coinminer_glassworm_hammertoss_hijackloader_icedid_luca-stealer_njrat_poet-rat_quasar-rat_stealc_vidar

.exe 30.6MB

2026-11-02_c31619bd09833f54c572fc3906c45432_coinminer_glassworm_hammertoss_hijackloader_icedid_luca-stealer_njrat_poet-rat_quasar-rat_stealc_vidar

IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
SHA256 1858a40496a1f027d267ec1409c84f17df43f46619f6f2ff7d25dbef1ffca8a8
MD5 c31619bd09833f54c572fc3906c45432
SHA1 8aa693d8b5b7fb962e8fb394a5c9d3100d94ffb4
SHA512 35d4c162658d1e0d94e02ac449c5043d7e99c2573f37277a0e5f71ddf2313dbafce35d402931b2ba5e4878ff4cb93cef2664c7cfcfe89dfd69f23466c4c7c133
SSDEEP 393216:0SD2sm2Eyxq5RAGEJjwZBKfiJyI4MoIhprEBEdBbkkB43:0SqIpeZBKSgMnrrkEd
TLSH
T16067AD1473E89F26C5AF4F75A0F1062093B6B44A6B62D78F328C56FA1F53B905D213A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Windows executables referencing non-Windows User-Agents
Detects encrypted or obfuscated .NET executables
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

72400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FreeLibrary LoadLibraryExW OutputDebugStringW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW GetModuleHandleW MultiByteToWideChar GetFileAttributesExW LoadLibraryA DeleteCriticalSection WideCharToMultiByte IsWow64Process TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetProcAddress GetWindowsDirectoryW FindResourceW GetLastError ActivateActCtx FindClose CreateActCtxW SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invoke_watson __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _errno _initialize_onexit_table abort _c_exit _register_thread_local_exe_atexit_callback terminate __p___wargv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode fputwc __p__commode fputws _wfsopen fflush __stdio_common_vfwprintf __stdio_common_vsnwprintf_s __stdio_common_vswprintf setvbuf

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcsncmp toupper strcmp strlen _wcsdup wcsnlen strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64_s _time64

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale ___lc_codepage_func ___lc_locale_name_func __pctype_func _lock_locales setlocale _unlock_locales

api-ms-win-crt-math-l1-1-0

__setusermatherr

Name

.text

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

824B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc2

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.voltbl

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data2

Size

7.3MB

Virtual Size

7.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_c31619bd09833f54c572fc3906c45432_coinminer_glassworm_hammertoss_hijackloader_icedid_luca-stealer_njrat_poet-rat_quasar-rat_stealc_vidar

kernel32

user32

shell32

advapi32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic