2026-11-01_8578587e2f12d1a5b48c83a952167c6b_coinminer_glassworm_icedid_njrat_pos_remcos_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_8578587e2f12d1a5b48c83a952167c6b_coinminer_glassworm_icedid_njrat_pos_remcos_vidar
Size 15.2MB
Sample261102-th3fksdv6p
SHA256 9be966994566ff2911f3a4d3348164b5e46834821e4b129c7e9300dbf4611ada
MD5 8578587e2f12d1a5b48c83a952167c6b
SHA1 462b1522c9186eb1a082aeb1b5a7d6d592531722
SHA512 4a4f885ae319016556bca99116678a319847905fc8beb7573a13bad63ff163b192a58cca23958470fbbba78cfc9b6056a03dec59e3dca23d2730ab05b09ef69b
SSDEEP 196608:DjNEe5c4OlNjejtChDPUExPrVuqN3aiXNixlr3QCA:DjNEcQlxejtCVPvRAiXNirrW
TLSH
T1B2F6D443BA948D22D8B5F336DB636E11B3A3B04C6F03D39721C8D7AA3907686AD1571D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects encrypted or obfuscated .NET executables 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_DotNET_Encrypted

Detects executables containing base64 encoded User Agent 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent

Detects executables packed with Dotfuscator 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Dotfuscator

File Explorer

2026-11-01_8578587e2f12d1a5b48c83a952167c6b_coinminer_glassworm_icedid_njrat_pos_remcos_vidar

.exe 15.2MB

2026-11-01_8578587e2f12d1a5b48c83a952167c6b_coinminer_glassworm_icedid_njrat_pos_remcos_vidar

IMPHASH d177e3a5c6d731edbac974fb104dd9ef
SHA256 9be966994566ff2911f3a4d3348164b5e46834821e4b129c7e9300dbf4611ada
MD5 8578587e2f12d1a5b48c83a952167c6b
SHA1 462b1522c9186eb1a082aeb1b5a7d6d592531722
SHA512 4a4f885ae319016556bca99116678a319847905fc8beb7573a13bad63ff163b192a58cca23958470fbbba78cfc9b6056a03dec59e3dca23d2730ab05b09ef69b
SSDEEP 196608:DjNEe5c4OlNjejtChDPUExPrVuqN3aiXNixlr3QCA:DjNEcQlxejtCVPvRAiXNirrW
TLSH
T1B2F6D443BA948D22D8B5F336DB636E11B3A3B04C6F03D39721C8D7AA3907686AD1571D
MD5 SHA1 SHA512 SSDEEP TLSH

Detects encrypted or obfuscated .NET executables
Detects executables containing base64 encoded User Agent
Detects executables packed with Dotfuscator

Digest

c8:77:69:81:e5:6b:62:12:eb:b1:b3:e8:74:ad:ab:83:8d:6e:e0:ec:01:3f:03:d5:2c:ea:a1:35:ca:39:88:af

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=NETANYA,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Aug 10, 2026

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=NETANYA,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=NETANYA,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

65:b8:bc:a3:50:81:74:21:2b:71:17:9d:67:d7:2e:fb:f3:16:0e:d7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=NETANYA,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Aug 10, 2026

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=NETANYA,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=NETANYA,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

SERIALNUMBER=514114842,CN=Bright Data Ltd,O=Bright Data Ltd,L=NETANYA,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

05:b0:d6:42:9e:35:e8:f3:fd:dc:a4:21:1e:c6:5f:93

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 28, 2025 - Nov 7, 2027

Minor OS version

Major OS version

Entry point

1918556

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\cygwin64\home\bat\bat\checkout\zon\build.app_win64r_obf\pkg\win\sdk\net_updater64.exe.pdb

wldap32

ord45 ord50 ord41 ord22 ord60 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord211 ord46 ord217 ord26 ord143

normaliz

IdnToAscii IdnToUnicode

ws2_32

WSAEventSelect WSAResetEvent shutdown WSAEnumNetworkEvents WSAWaitForMultipleEvents WSACloseEvent send getsockopt WSACreateEvent closesocket gethostname ioctlsocket getpeername sendto recvfrom freeaddrinfo getaddrinfo recv listen htonl getsockname connect bind accept select __WSAFDIsSet socket htons WSAIoctl setsockopt WSACleanup WSAStartup WSASetLastError ntohs WSAGetLastError

crypt32

CertDeleteCertificateFromStore CryptAcquireCertificatePrivateKey CertStrToNameW CertGetNameStringW CryptQueryObject CertCreateSelfSignCertificate CertEnumCertificatesInStore CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertFindExtension CertGetNameStringA CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertAddCertificateContextToStore CertGetCertificateContextProperty CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CryptMsgGetParam CryptMsgUpdate CryptMsgClose CryptMsgOpenToDecode

wintrust

WinVerifyTrust WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WTHelperProvDataFromStateData

advapi32

CryptImportKey RegQueryValueExA RegOpenKeyExA RegDeleteKeyExA RegCreateKeyExA RegCloseKey SetSecurityDescriptorDacl MakeSelfRelativeSD InitializeSecurityDescriptor InitializeAcl SetEntriesInAclW SetNamedSecurityInfoW GetLengthSid ReportEventA RegisterEventSourceA DeregisterEventSource CryptGenRandom CryptAcquireContextW LookupPrivilegeValueW AdjustTokenPrivileges CheckTokenMembership OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW StartServiceW SetServiceObjectSecurity QueryServiceStatusEx OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW CreateProcessAsUserW CryptEncrypt RegSetValueExA CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam FreeSid AllocateAndInitializeSid AddAccessDeniedAce AddAccessAllowedAce RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW CryptReleaseContext CryptAcquireContextA

winhttp

WinHttpSetStatusCallback WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpOpen WinHttpCloseHandle WinHttpSendRequest WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpQueryHeaders

kernel32

GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFullPathNameW SetFileTime GetSystemTimeAdjustment GetTimeZoneInformation UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead LoadLibraryExW ExitProcess GetModuleHandleExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateThread ExitThread FreeLibraryAndExitThread SetFilePointerEx SetStdHandle WaitForSingleObject GetModuleFileNameA WriteConsoleW DeleteFileW GetConsoleCP SetEnvironmentVariableA SetEnvironmentVariableW GetCurrentDirectoryW CreateDirectoryW RemoveDirectoryW GetCommandLineA GetACP HeapReAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW MoveFileExW GetStringTypeW FlushFileBuffers SetEndOfFile IsValidCodePage GetOEMCP GetCPInfo FreeEnvironmentStringsW FindFirstFileExA SetConsoleMode ReadConsoleW ReadConsoleA GetCommandLineW CloseHandle GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW LocalFree SetDllDirectoryW SetSearchPathMode WideCharToMultiByte SetLastError HeapAlloc HeapFree GetProcessHeap GetNativeSystemInfo VirtualAlloc VirtualProtect VirtualFree FreeLibrary GetProcAddress LoadLibraryA IsBadReadPtr ReleaseSRWLockExclusive AcquireSRWLockExclusive GetLastError FormatMessageW QueryPerformanceCounter GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA Sleep MultiByteToWideChar MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetCurrentProcessId GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects SleepEx VerSetConditionMask VerifyVersionInfoW CreateFileA GetFileSizeEx RaiseException GetSystemInfo VirtualQuery LoadLibraryExA IsDebuggerPresent OutputDebugStringW GetTempPathW SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetExitCodeProcess OpenProcess HeapSize CreateToolhelp32Snapshot GetCurrentThread GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext Thread32First Thread32Next Module32FirstW Module32NextW GetEnvironmentStringsW DuplicateHandle CreateProcessW WTSGetActiveConsoleSessionId InitializeCriticalSection TerminateThread QueueUserAPC SetConsoleCtrlHandler GetModuleFileNameW GetVersionExW ReadFileEx WriteFile WriteFileEx SetHandleInformation ConnectNamedPipe SetNamedPipeHandleState LoadLibraryW CreateFileW FindClose FindFirstFileW FindNextFileW CreateNamedPipeW CancelIo UnregisterWaitEx RegisterWaitForSingleObject GetModuleHandleExA RtlVirtualUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime OutputDebugStringA SwitchToFiber DeleteFiber CreateFiber GetSystemTime SystemTimeToFileTime ConvertFiberToThread ConvertThreadToFiber FindFirstFileA FindNextFileA GetEnvironmentVariableW GetConsoleMode

userenv

CreateEnvironmentBlock

bcrypt

BCryptGenRandom

shell32

SHGetKnownFolderPath CommandLineToArgvW SHGetFolderPathW ShellExecuteExW

wtsapi32

WTSQueryUserToken

ntdll

NtTestAlert NtFsControlFile NtCreateFile RtlInitUnicodeString NtCreateSection NtMapViewOfSection NtUnmapViewOfSection RtlUnwindEx RtlLookupFunctionEntry NtQuerySystemInformation NtDeviceIoControlFile RtlCaptureContext

iphlpapi

GetExtendedUdpTable GetExtendedTcpTable GetAdaptersInfo

psapi

GetModuleFileNameExW EnumProcessModules GetModuleInformation

winmm

timeEndPeriod timeBeginPeriod timeGetTime

user32

GetUserObjectInformationW GetProcessWindowStation MsgWaitForMultipleObjectsEx MessageBoxA

ncrypt

NCryptFreeObject NCryptFinalizeKey NCryptSetProperty NCryptCreatePersistedKey NCryptOpenKey NCryptDeleteKey NCryptOpenStorageProvider

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_8578587e2f12d1a5b48c83a952167c6b_coinminer_glassworm_icedid_njrat_pos_remcos_vidar

wldap32

normaliz

ws2_32

crypt32

wintrust

advapi32

winhttp

kernel32

userenv

bcrypt

shell32

wtsapi32

ntdll

iphlpapi

psapi

winmm

user32

ncrypt

generic