2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc
Size 7.4MB
Sample261110-166apsbf97
SHA256 fd609e0e14580f183b1956436478f10f3b22f398704c3b3ff4ce59ec1d6907d8
MD5 3bc23f413c381f8e847920a9d9b230e9
SHA1 0eb2c1ae375c187b2c0b2b7a4d27ef17e8321112
SHA512 c0a3550b433ad86a9bdb6336942d770afbc05a8f9323b18082656ac9c662112b8e21adc1a7ac7aa1b4a4ebbd7e1c5d764a4cf1177544221c50c7ceea852d35b9
SSDEEP 49152:DSkU6GEi1PXegT+fijaDk77GkfYhcIrlx/jyR+OuFilq7eSaSwPeP+1fClcK9IQx:s7GbhlcRPecClcSPouC+F7n+cUJTy
TLSH
T101767B47EAB250E5C8BAC23886536223FEB1B8498730A7D7469456170F73BF0AE3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

.exe 7.4MB

2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH d1dd56e77b745d56ff918e53015b34e0
SHA256 fd609e0e14580f183b1956436478f10f3b22f398704c3b3ff4ce59ec1d6907d8
MD5 3bc23f413c381f8e847920a9d9b230e9
SHA1 0eb2c1ae375c187b2c0b2b7a4d27ef17e8321112
SHA512 c0a3550b433ad86a9bdb6336942d770afbc05a8f9323b18082656ac9c662112b8e21adc1a7ac7aa1b4a4ebbd7e1c5d764a4cf1177544221c50c7ceea852d35b9
SSDEEP 49152:DSkU6GEi1PXegT+fijaDk77GkfYhcIrlx/jyR+OuFilq7eSaSwPeP+1fClcK9IQx:s7GbhlcRPecClcSPouC+F7n+cUJTy
TLSH
T101767B47EAB250E5C8BAC23886536223FEB1B8498730A7D7469456170F73BF0AE3D754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4652272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Jenkins\workspace\ebAdvisor_WABinary_release_4.1.2\build\x64\Release\BrowserHost.pdb

kernel32

WTSGetActiveConsoleSessionId GetCurrentProcess GetEnvironmentVariableW ProcessIdToSessionId OpenProcess CreateToolhelp32Snapshot Process32FirstW QueryFullProcessImageNameW Process32NextW GetProcessTimes CloseHandle K32EnumProcesses TerminateProcess lstrcmpiW GetCurrentThreadId ResetEvent WaitNamedPipeW CreateFileW GetNamedPipeClientProcessId CancelIoEx GetOverlappedResult GetFileSizeEx SetLastError VirtualFree UnmapViewOfFile VirtualAlloc VirtualQuery IsDebuggerPresent RtlCaptureContext RaiseFailFastException SetUnhandledExceptionFilter IsProcessorFeaturePresent LCMapStringEx GetFileInformationByHandleEx GetFinalPathNameByHandleW SetFileInformationByHandle DeviceIoControl SetFilePointerEx ReadDirectoryChangesW GetNativeSystemInfo GetLargePageMinimum GetModuleHandleExW GetSystemDirectoryW LoadLibraryExW FileTimeToSystemTime SystemTimeToFileTime GetCommandLineW IsWow64Process IsWow64Process2 GetComputerNameW GlobalAlloc GetUserDefaultUILanguage SetFilePointer OutputDebugStringW ReleaseMutex GetSystemTimeAsFileTime GetVolumeInformationW CreateMutexW GetUserPreferredUILanguages LCIDToLocaleName GetPrivateProfileStringW GetFileSize CopyFileW GetShortPathNameW FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime LockFileEx UnlockFile HeapCompact LoadLibraryW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx GetFullPathNameA LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualProtect GetACP ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetSystemDirectoryA GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW VerifyVersionInfoW VerSetConditionMask CreateMutexA CreateDirectoryA FindFirstFileA FindNextFileA GetFileAttributesExA RemoveDirectoryA CreateFileMappingA MoveFileA ReplaceFileA WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTempPathW CreateDirectoryW FindNextFileW FindFirstFileW GetFileAttributesW MoveFileExW Sleep DeleteFileW GetModuleFileNameW FindClose LocalAlloc FormatMessageW GetCurrentProcessId WriteFile ReadFile GetSystemInfo WaitForSingleObject GetLocalTime GetNamedPipeServerProcessId GetFileType GetStdHandle LocalFree GlobalFree GetModuleHandleW GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy DecodePointer DeleteCriticalSection InitializeCriticalSectionEx WideCharToMultiByte MultiByteToWideChar WaitForMultipleObjects TerminateThread SetEvent GetLastError CreateEventW GetProcAddress LoadLibraryExA FreeLibrary GetLogicalProcessorInformation RtlCaptureStackBackTrace InitializeConditionVariable SetEndOfFile GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineA SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW SetStdHandle ExitProcess SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread CreateThread InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry InitializeSListHead GetCPInfo CompareStringEx EncodePointer GetStringTypeW TryAcquireSRWLockExclusive SwitchToThread QueryPerformanceFrequency InitOnceBeginInitialize InitOnceComplete GetLocaleInfoEx GetCurrentDirectoryW FindFirstFileExW GetFileInformationByHandle CreateHardLinkW CreateSymbolicLinkW WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader RtlUnwind

user32

CharLowerBuffW LoadStringW CharLowerBuffA CharUpperBuffA MessageBoxW GetUserObjectInformationW GetProcessWindowStation CharUpperBuffW

advapi32

RegCreateKeyExW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegEnumKeyExW RegQueryInfoKeyW ConvertSidToStringSidA OpenServiceA RegEnumValueW LookupAccountNameW RegCloseKey ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegOpenKeyExA SetNamedSecurityInfoW GetSecurityDescriptorDacl OpenServiceW OpenSCManagerW QueryServiceConfigA QueryServiceStatus ConvertStringSecurityDescriptorToSecurityDescriptorW CloseServiceHandle RegGetValueW RegSetValueExA RegSetValueExW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegNotifyChangeKeyValue

shell32

SHGetKnownFolderPath SHGetSpecialFolderPathW

ole32

OleRun CoInitializeEx CoTaskMemFree CoUninitialize CoSetProxyBlanket CoCreateInstance

oleaut32

SysFreeString VariantInit SafeArrayGetElement SysAllocString SysStringLen VariantChangeType VariantClear

shlwapi

PathCombineW PathFileExistsW StrRChrW PathIsRelativeW PathIsDirectoryA

dbghelp

SymFromAddr

Name

.text

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

183KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

584B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

815KB

Virtual Size

816KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_3bc23f413c381f8e847920a9d9b230e9_coinminer_glassworm_icedid_luca-stealer_njrat_stealc

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

dbghelp

generic