2026-11-01_eecd09a21cf27363768e05e87b025dae_coinminer_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_eecd09a21cf27363768e05e87b025dae_coinminer_glassworm_icedid_njrat
Size 13.3MB
Sample261102-efppdasv4k
SHA256 ac8d3dea0b7c75d962306eb7264e9cea7d36d43ae39939d14ae8544a6b6d2300
MD5 eecd09a21cf27363768e05e87b025dae
SHA1 fd9d95f4e5f1b7c4826656308cfe255c1000849a
SHA512 c176d2247006bb625b63dd060fcd1b6f9fc983a580d0508e4f5f6554c6ffcbb305454218e1bd74daf23ddc0d91b0119311d6e9bbc9110ce4d231ad16814cc50e
SSDEEP 49152:3JQ20HeUww0w6gPbhb8FPds7tg5ORbfQI2VmyIWE3LPNQMjBLvju8FoiGTjAgy1M:31Ce6GkWE3hFgyIra9Rdkj
TLSH
T1A6E6C447FB7640C2D4BAC0399652E62BFCB13899C374A7DB97415B561B22BE0AE3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_eecd09a21cf27363768e05e87b025dae_coinminer_glassworm_icedid_njrat

File Explorer

2026-11-01_eecd09a21cf27363768e05e87b025dae_coinminer_glassworm_icedid_njrat

.exe 13.3MB

2026-11-01_eecd09a21cf27363768e05e87b025dae_coinminer_glassworm_icedid_njrat

IMPHASH 83a3331aa7800be3775515c718ac8a42
SHA256 ac8d3dea0b7c75d962306eb7264e9cea7d36d43ae39939d14ae8544a6b6d2300
MD5 eecd09a21cf27363768e05e87b025dae
SHA1 fd9d95f4e5f1b7c4826656308cfe255c1000849a
SHA512 c176d2247006bb625b63dd060fcd1b6f9fc983a580d0508e4f5f6554c6ffcbb305454218e1bd74daf23ddc0d91b0119311d6e9bbc9110ce4d231ad16814cc50e
SSDEEP 49152:3JQ20HeUww0w6gPbhb8FPds7tg5ORbfQI2VmyIWE3LPNQMjBLvju8FoiGTjAgy1M:31Ce6GkWE3hFgyIra9Rdkj
TLSH
T1A6E6C447FB7640C2D4BAC0399652E62BFCB13899C374A7DB97415B561B22BE0AE3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82446

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\source\repo\engine\trunk\db\norm\updater\build\windows_x86_64_Debug\bin\Debug\norm-updater.pdb

ws2_32

WSAIoctl WSASetLastError htonl setsockopt getsockopt select shutdown ntohl ioctlsocket getnameinfo inet_pton freeaddrinfo getaddrinfo WSAGetLastError WSACleanup WSAStartup socket send recv connect getsockname closesocket

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetFileSizeEx IsDebuggerPresent CloseHandle GetLastError GetCurrentProcess FlushProcessWriteBuffers GetSystemInfo VirtualAlloc VirtualFree VirtualAllocEx VirtualFreeEx GetLargePageMinimum GetProcessWorkingSetSize SetProcessWorkingSetSizeEx VirtualLock FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary SystemTimeToFileTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx LocalFree GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile SetFilePointerEx GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId InitOnceExecuteOnce FindClose FindFirstFileW FindNextFileW ReleaseMutex CreateMutexA TerminateProcess MoveFileExA GetModuleFileNameA GetStdHandle GetFileType GetConsoleMode SetConsoleMode CompareStringW GetTimeZoneInformation SetStdHandle IsValidCodePage EnumSystemLocalesW OutputDebugStringW RemoveDirectoryW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber SetConsoleCtrlHandler HeapQueryInformation GetCurrentThread UnhandledExceptionFilter GetConsoleOutputCP ReadConsoleW GetCommandLineW GetCommandLineA FileTimeToSystemTime SleepEx SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW WriteConsoleW FreeLibraryAndExitThread ResumeThread RemoveDirectoryA CreateDirectoryA LoadLibraryExA SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP QueryPerformanceFrequency GetSystemTimePreciseAsFileTime SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileAttributesW SetFileInformationByHandle SetFileTime CreateFile2 DeviceIoControl GetModuleHandleW CreateDirectoryExW CopyFile2 MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive LoadLibraryExW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead VirtualQuery InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetModuleHandleExW ExitProcess IsProcessorFeaturePresent CreateThread ExitThread GetACP

advapi32

CryptAcquireContextA LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken CryptGenRandom GetUserNameA

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress

bcrypt

BCryptGenRandom

secur32

FreeCredentialsHandle InitializeSecurityContextA FreeContextBuffer DeleteSecurityContext AcquireCredentialsHandleA

ntdll

RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlUnwindEx RtlCaptureContext RtlVirtualUnwind RtlUnwind RtlPcToFileHeader

shell32

SHGetFolderPathA

Name

.text

Size

9.8MB

Virtual Size

9.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

437KB

Virtual Size

459KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

538KB

Virtual Size

538KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_eecd09a21cf27363768e05e87b025dae_coinminer_glassworm_icedid_njrat

ws2_32

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

bcrypt

secur32

ntdll

shell32

generic