2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 15.7MB
Sample261102-b5k6psdh43
SHA256 4f6ed07a4cd1f6e71f8eb4fc9cf8e16c1ec17942258e34c61e72c01e5ee07148
MD5 fd254244ab814e4e52b4953d0b280cdd
SHA1 e142ff89f9ef71080a98aa3707680972aa8300cb
SHA512 7b01a560968be93a6c7da758509d743cbb427bbd21477fb9d3dad052ffaecf91fcafcf6236f37bd2ebfaaab1b65f97bc4bb67eb1154f161b0993a0d0fde8b496
SSDEEP 196608:2XOtGSm12GnqRloSXBYVx6ebU5prlUQQl6DRDqYc:2XOtGSmAqqYSRYVxFbUzrlBQlYDq
TLSH
T1FFF68E2662BC00EDD0BBC17DC6469A0BE7B27855437097DF0AE486B61F23AE45E7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 15.7MB

2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH be1e86af2be65ba7735ea2cf146d99c8
SHA256 4f6ed07a4cd1f6e71f8eb4fc9cf8e16c1ec17942258e34c61e72c01e5ee07148
MD5 fd254244ab814e4e52b4953d0b280cdd
SHA1 e142ff89f9ef71080a98aa3707680972aa8300cb
SHA512 7b01a560968be93a6c7da758509d743cbb427bbd21477fb9d3dad052ffaecf91fcafcf6236f37bd2ebfaaab1b65f97bc4bb67eb1154f161b0993a0d0fde8b496
SSDEEP 196608:2XOtGSm12GnqRloSXBYVx6ebU5prlUQQl6DRDqYc:2XOtGSmAqqYSRYVxFbUzrlBQlYDq
TLSH
T1FFF68E2662BC00EDD0BBC17DC6469A0BE7B27855437097DF0AE486B61F23AE45E7E350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b4:63:d5:ff:58:8a:d7:a2:b9:27:cc:34:12:f1:ed:87:87:40:ce:05:aa:d7:ec:67:e5:86:1f:39:28:cc:22:14

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Incredibuild Software ltd.,O=Incredibuild Software ltd.,L=Tel Aviv,ST=Tel Aviv,C=IL

Chains

Oct 7, 2026

CN=Incredibuild Software ltd.,O=Incredibuild Software ltd.,L=Tel Aviv,ST=Tel Aviv,C=IL

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Incredibuild Software ltd.,O=Incredibuild Software ltd.,L=Tel Aviv,ST=Tel Aviv,C=IL

Serial Number

33:00:07:b3:e0:b3:06:16:d7:b2:8c:87:cf:00:00:00:07:b3:e0

Issuer

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 5, 2026 - Oct 8, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:15:05:3e:6e:19:8e:93:29:d9:00:00:00:00:00:15

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:491A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5a:f6:0d:67:8c:85:ed:dd:08:00:00:00:00:00:5a

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

16489808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize

shell32

SHGetKnownFolderPath

advapi32

ControlService RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptGenRandom CryptDestroyKey SetNamedSecurityInfoA OpenProcessToken CopySid GetLengthSid GetTokenInformation IsValidSid DeregisterEventSource RegisterEventSourceA ReportEventA GetUserNameA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegCloseKey RegOpenKeyExA RegOpenKeyExW RegQueryValueExA ChangeServiceConfigA ChangeServiceConfig2A CloseServiceHandle RegGetValueA CreateServiceA DeleteService OpenSCManagerA OpenServiceA QueryServiceStatus RegisterServiceCtrlHandlerA SetServiceStatus StartServiceCtrlDispatcherA CryptSetHashParam CryptGetProvParam RegEnumKeyExA RegNotifyChangeKeyValue SystemFunction036 CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey

user32

MessageBoxW GetUserObjectInformationW GetProcessWindowStation

iphlpapi

NotifyIpInterfaceChange if_indextoname GetUnicastIpAddressTable FreeMibTable GetAdaptersAddresses if_nametoindex GetBestRoute2 CancelMibChangeNotify2

ws2_32

WSAStartup WSACleanup bind closesocket ioctlsocket getsockname htonl htons listen gethostname getservbyname getservbyport gethostbyname gethostbyaddr inet_ntoa inet_addr sendto recvfrom send recv WSARecvFrom WSAConnect inet_ntop inet_pton WSAGetOverlappedResult WSASocketA socket shutdown ntohl freeaddrinfo getaddrinfo WSAAddressToStringW WSARecv WSAIoctl select getsockopt connect accept __WSAFDIsSet WSAStringToAddressW WSASocketW WSASend WSAGetLastError WSASetLastError setsockopt ntohs getpeername

wsock32

ord1142 ord1141

dbghelp

SymFromAddr

bcrypt

BCryptGenRandom BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

kernel32

SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread LoadLibraryExW InterlockedPushEntrySList GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW WaitForThreadpoolWorkCallbacks IsProcessorFeaturePresent GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetFileInformationByHandleEx MoveFileExW SetFileInformationByHandle GetFinalPathNameByHandleW GetStdHandle WriteFile CloseHandle GetLastError PostQueuedCompletionStatus EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObject SleepEx CreateEventW Sleep WaitForMultipleObjects QueueUserAPC GetCurrentProcessId GetCurrentThreadId TerminateThread GetSystemInfo LocalFree FormatMessageA FormatMessageW GetDynamicTimeZoneInformation WideCharToMultiByte GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute CreateMutexW ReleaseMutex MultiByteToWideChar GetFileSizeEx CreateFile2 OutputDebugStringA SetLastError CreateIoCompletionPort GetQueuedCompletionStatus SetWaitableTimer CreateFileMappingW MapViewOfFile UnmapViewOfFile AreFileApisANSI GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW IsProcessInJob CreateJobObjectW AssignProcessToJobObject TerminateJobObject GetModuleHandleW GetProcAddress CreateWaitableTimerA CancelIoEx GetSystemTimeAsFileTime VirtualFree CreateFileW ReadFile SetEndOfFile SetFilePointerEx VirtualAlloc GetModuleHandleA GetEnvironmentVariableW GetModuleFileNameW IsDebuggerPresent PeekNamedPipe OpenProcess QueryFullProcessImageNameA GetTimeZoneInformation CreateEventA ExitProcess GetModuleFileNameA CreateProcessA CreatePipe SetInformationJobObject QueryInformationJobObject CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteConsoleW GetCurrentDirectoryW FindClose FindFirstFileW FindNextFileW FreeEnvironmentStringsW ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiberEx GetSystemTime SystemTimeToFileTime GetSystemDirectoryA FreeLibrary LoadLibraryA InitializeCriticalSection TryEnterCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetACP GetFileType RtlVirtualUnwind ConvertFiberToThread ConvertThreadToFiberEx SetConsoleMode ReadConsoleA ReadConsoleW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable CreateThread RegisterWaitForSingleObject UnregisterWait ExpandEnvironmentStringsA QueryPerformanceCounter QueryPerformanceFrequency GetQueuedCompletionStatusEx SetFileCompletionNotificationModes GetCurrentProcessorNumber GetEnvironmentVariableA SleepConditionVariableSRW GetLogicalProcessorInformation FlushFileBuffers GetTickCount GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate GetFileAttributesW GetTempPathW UnlockFileEx GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate RaiseException GetFileInformationByHandle GetDiskFreeSpaceExW FindFirstFileExW CreateDirectoryW InitOnceComplete InitOnceBeginInitialize GetLocaleInfoEx TryAcquireSRWLockExclusive GetNativeSystemInfo FlsAlloc GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetStdHandle SetEnvironmentVariableW GetConsoleOutputCP GetCommandLineA GetCommandLineW SetHandleInformation FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetOEMCP GetEnvironmentStringsW GetSystemDirectoryW InitializeSRWLock GetTickCount64 SwitchToThread

oleaut32

SysAllocString SysFreeString

ntdll

RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlUnwind

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW

Name

.text

Size

11.0MB

Virtual Size

11.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

479KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

502KB

Virtual Size

501KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

153KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_fd254244ab814e4e52b4953d0b280cdd_akira_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

PE Signature issue

ole32

shell32

advapi32

user32

iphlpapi

ws2_32

wsock32

dbghelp

bcrypt

kernel32

oleaut32

ntdll

crypt32

generic