2026-11-01_fcc9a95170ce77617258ed1e5a0d8499_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_fcc9a95170ce77617258ed1e5a0d8499_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_vidar
Size 33.3MB
Sample261102-b7zrwadh45
SHA256 97c4725a0fb24c35fb110d8c3970311fde4fe86b1da714f4c18a36ae48a40e51
MD5 fcc9a95170ce77617258ed1e5a0d8499
SHA1 4e8621effbdcbf6604f4496f7757a1bc353a6d14
SHA512 7d05e907a63dc27f6043ac68be7088cfe736a2d5064519247d564fdbc61e98cdc80be2a5b6f08fff3449e193d0f8852fecbbcf32fe06c4d80ea32eb0b7f11c6a
SSDEEP 196608:H3HoFdMWygaTjM93KNuuWBtfXkRfAhJlSuM2gCW/XE99GDr8XPrFzCTg3ta02eKZ:H3ygdtfAh4g9GDqyZUaZk79s
TLSH
T181777C107BF85F2AD2AF473AB871626587B1E5466322E34B19C8E5A83C537B04E113F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects encrypted or obfuscated .NET executables 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_DotNET_Encrypted

File Explorer

2026-11-01_fcc9a95170ce77617258ed1e5a0d8499_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_vidar

.exe 33.3MB

2026-11-01_fcc9a95170ce77617258ed1e5a0d8499_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_vidar

IMPHASH 7a8c872f8e13d32f36a675b52eda1d6e
SHA256 97c4725a0fb24c35fb110d8c3970311fde4fe86b1da714f4c18a36ae48a40e51
MD5 fcc9a95170ce77617258ed1e5a0d8499
SHA1 4e8621effbdcbf6604f4496f7757a1bc353a6d14
SHA512 7d05e907a63dc27f6043ac68be7088cfe736a2d5064519247d564fdbc61e98cdc80be2a5b6f08fff3449e193d0f8852fecbbcf32fe06c4d80ea32eb0b7f11c6a
SSDEEP 196608:H3HoFdMWygaTjM93KNuuWBtfXkRfAhJlSuM2gCW/XE99GDr8XPrFzCTg3ta02eKZ:H3ygdtfAh4g9GDqyZUaZk79s
TLSH
T181777C107BF85F2AD2AF473AB871626587B1E5466322E34B19C8E5A83C537B04E113F7
MD5 SHA1 SHA512 SSDEEP TLSH

Detects encrypted or obfuscated .NET executables

Digest

72:13:3b:22:4b:cd:2a:83:cc:fa:ec:78:5b:ba:67:01:d6:fc:5a:8b:83:db:91:40:47:7c:a4:af:f9:5c:b0:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=04.626.836/0001-57,CN=MT4 Tecnologia LTDA,O=MT4 Tecnologia LTDA,L=São Paulo,ST=São Paulo,C=BR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024252

Chains

Oct 27, 2026

SERIALNUMBER=04.626.836/0001-57,CN=MT4 Tecnologia LTDA,O=MT4 Tecnologia LTDA,L=São Paulo,ST=São Paulo,C=BR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024252

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=04.626.836/0001-57,CN=MT4 Tecnologia LTDA,O=MT4 Tecnologia LTDA,L=São Paulo,ST=São Paulo,C=BR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024252

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=04.626.836/0001-57,CN=MT4 Tecnologia LTDA,O=MT4 Tecnologia LTDA,L=São Paulo,ST=São Paulo,C=BR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024252

Serial Number

08:94:7f:1e:27:cd:84:69:ab:a8:71:68:d4:90:95:a4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 16, 2025 - Jun 15, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

75200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

shell32

ShellExecuteW

advapi32

RegCloseKey ReportEventW RegisterEventSourceW RegOpenKeyExW RegGetValueW DeregisterEventSource

kernel32

GetSystemTimeAsFileTime TlsFree CreateActCtxW ActivateActCtx GetLastError FindResourceW GetWindowsDirectoryW GetProcAddress GetModuleHandleW FreeLibrary LoadLibraryExW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetStdHandle GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW FindClose MultiByteToWideChar GetConsoleMode GetFileAttributesExW LoadLibraryA WriteConsoleW DeleteCriticalSection WideCharToMultiByte IsWow64Process OutputDebugStringW TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter

user32

MessageBoxW

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _exit exit _initterm_e _errno _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table abort _invoke_watson

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc malloc _callnewh free

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s wcsftime

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf __p__commode fputwc __acrt_iob_func __stdio_common_vswprintf _set_fmode _wfsopen fflush setvbuf __stdio_common_vsnwprintf_s

api-ms-win-crt-locale-l1-1-0

_create_locale ___mb_cur_max_func ___lc_codepage_func ___lc_locale_name_func __pctype_func _configthreadlocale setlocale _lock_locales _free_locale _unlock_locales

api-ms-win-crt-string-l1-1-0

strlen strcmp wcsncmp toupper strcpy_s _wcsdup wcsnlen

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_fcc9a95170ce77617258ed1e5a0d8499_coinminer_glassworm_helldown_icedid_luca-stealer_njrat_vidar

shell32

advapi32

kernel32

user32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

generic