2026-11-06_dae7cbb195fa167f742fc9ef49ab0fd3_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-06_dae7cbb195fa167f742fc9ef49ab0fd3_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 5.5MB
Sample261107-1ff8wsfv91
SHA256 8310e5633ee7049e16b7799f9382b02a2ebf6227a53ba5ba60312aa85aeb35e0
MD5 dae7cbb195fa167f742fc9ef49ab0fd3
SHA1 ac16a5f0db8438918babe46d0f67030f5abebf42
SHA512 648b36dd6d998b64d8c6cf71018dbe1be31f5a308a4a9d84aa7990b4ce1794ec169322b40ccde72b8723d5f8d1e6a5b3c569158ae8a9c03b50fe76a27b0e22c7
SSDEEP 49152:6dVZgM0TqpiSdAsb2r87TgNvIiyUDbsAR/li39WHPmk8IEpUEvIEpUEe8IEpUEvi:VtjNhM9W0WUqX
TLSH
T189464B1591F942ECC077E1BBC906954FEAA27C95C328DBE710EC92250F5A3DC8A7F609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-06_dae7cbb195fa167f742fc9ef49ab0fd3_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-06_dae7cbb195fa167f742fc9ef49ab0fd3_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 5.5MB

2026-11-06_dae7cbb195fa167f742fc9ef49ab0fd3_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 5ca93f5145b22902771bc56e2517e4b2
SHA256 8310e5633ee7049e16b7799f9382b02a2ebf6227a53ba5ba60312aa85aeb35e0
MD5 dae7cbb195fa167f742fc9ef49ab0fd3
SHA1 ac16a5f0db8438918babe46d0f67030f5abebf42
SHA512 648b36dd6d998b64d8c6cf71018dbe1be31f5a308a4a9d84aa7990b4ce1794ec169322b40ccde72b8723d5f8d1e6a5b3c569158ae8a9c03b50fe76a27b0e22c7
SSDEEP 49152:6dVZgM0TqpiSdAsb2r87TgNvIiyUDbsAR/li39WHPmk8IEpUEvIEpUEe8IEpUEvi:VtjNhM9W0WUqX
TLSH
T189464B1591F942ECC077E1BBC906954FEAA27C95C328DBE710EC92250F5A3DC8A7F609
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3243860

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

accept WSAIoctl bind send recv freeaddrinfo getaddrinfo WSAStringToAddressW WSASocketW WSASend WSARecv __WSAFDIsSet WSAGetLastError WSASetLastError WSACleanup WSAStartup shutdown setsockopt select ntohl listen htons htonl getsockopt getsockname ioctlsocket connect closesocket

crypt32

CertEnumCertificatesInStore CertCloseStore CertOpenSystemStoreW

kernel32

GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle SetFilePointerEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetEnvironmentStringsW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapQueryInformation HeapSize HeapReAlloc FreeEnvironmentStringsW SetEnvironmentVariableW LCMapStringW GetProcessHeap CloseHandle GetLastError SetLastError CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CancelIoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent WaitForSingleObject SleepEx CreateEventW SetWaitableTimer Sleep QueueUserAPC TerminateThread GetSystemTimeAsFileTime GetModuleHandleA GetProcAddress LocalFree FormatMessageA FormatMessageW CreateWaitableTimerA MultiByteToWideChar WideCharToMultiByte CreateFileW GetFileSizeEx ReadFile GetCurrentProcessId GetModuleFileNameW GetSystemTime SystemTimeToFileTime GetModuleHandleExA GetStdHandle GetFileType WriteFile GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FindClose FindFirstFileA FindNextFileA QueryPerformanceCounter ConvertFiberToThread ConvertThreadToFiber FreeLibrary LoadLibraryA GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteConsoleW SetEndOfFile WaitForMultipleObjects GetModuleHandleW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime RtlPcToFileHeader RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetTickCount64 RtlUnwind QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread TryAcquireSRWLockExclusive GetLocaleInfoEx GetCurrentDirectoryW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI GetFileInformationByHandleEx InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW SetConsoleCtrlHandler ExitProcess GetDriveTypeW PeekNamedPipe

user32

GetUserObjectInformationW MessageBoxA GetProcessWindowStation

advapi32

RegisterEventSourceA DeregisterEventSource ReportEventA

bcrypt

BCryptGenRandom

Name

.text

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

462KB

Virtual Size

518KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-06_dae7cbb195fa167f742fc9ef49ab0fd3_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

ws2_32

crypt32

kernel32

user32

advapi32

bcrypt

generic