2026-11-10_f4506a8ad5f49a633e27cb9f28d2293e_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-10_f4506a8ad5f49a633e27cb9f28d2293e_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_vidar
Size 48.0MB
Sample261110-e94ematw5q
SHA256 05510f5c1cc2df1879a31dc92de85e07160ccc342d1ff1874a0d1e95810cfe4f
MD5 f4506a8ad5f49a633e27cb9f28d2293e
SHA1 ff028a47e333135dbaf8ba9c307dc836237072e1
SHA512 ce3c28b98e31eb17e786106d4535b6f44dd5b6bd035b91a4b0c59452cc805f9a69dae5cb7a9c7962b048cb7c0c3ebffc993c37f4c961846b4386fedf10aad85a
SSDEEP 393216:q9xL1R3l3sYcKZtny4vgtVZp/QR8F8W+R290Ac52SBLvnh2pc7pT88ek07SaGZf+:sbl3xhMrQ1cvsLZWR7VqiIHy0ob
TLSH
T162B7CF45B2AD01DCD56BC078C6979617E7F17C691360DFEB5A908EA52F2BBD03A3A300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-10_f4506a8ad5f49a633e27cb9f28d2293e_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_vidar

File Explorer

2026-11-10_f4506a8ad5f49a633e27cb9f28d2293e_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_vidar

.exe 48.0MB

2026-11-10_f4506a8ad5f49a633e27cb9f28d2293e_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_vidar

IMPHASH 8c61476048b03270e6be042de80eeb33
SHA256 05510f5c1cc2df1879a31dc92de85e07160ccc342d1ff1874a0d1e95810cfe4f
MD5 f4506a8ad5f49a633e27cb9f28d2293e
SHA1 ff028a47e333135dbaf8ba9c307dc836237072e1
SHA512 ce3c28b98e31eb17e786106d4535b6f44dd5b6bd035b91a4b0c59452cc805f9a69dae5cb7a9c7962b048cb7c0c3ebffc993c37f4c961846b4386fedf10aad85a
SSDEEP 393216:q9xL1R3l3sYcKZtny4vgtVZp/QR8F8W+R290Ac52SBLvnh2pc7pT88ek07SaGZf+:sbl3xhMrQ1cvsLZWR7VqiIHy0ob
TLSH
T162B7CF45B2AD01DCD56BC078C6979617E7F17C691360DFEB5A908EA52F2BBD03A3A300
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5244544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

bcrypt

BCryptCloseAlgorithmProvider BCryptHash BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptGenRandom BCryptKeyDerivation BCryptEncrypt BCryptSetProperty BCryptOpenAlgorithmProvider

kernel32

GetProcessId GetModuleHandleA GetExitCodeThread Sleep GetTickCount64 LoadLibraryA Module32FirstW VirtualProtectEx GetProcAddress VirtualAllocEx ReadProcessMemory CreateRemoteThread Module32NextW VirtualFreeEx GetSystemFirmwareTable DeviceIoControl CreateFileW SetFileAttributesW MultiByteToWideChar DeleteFileW LocalFree WideCharToMultiByte IsWow64Process GetTickCount WriteFile TerminateProcess GetVersionExW GetFileAttributesExW MoveFileExW CreateEventW GetLocaleInfoA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetModuleFileNameA RemoveDirectoryW GetTempPathA DeleteFileA LoadLibraryW SetDllDirectoryW MoveFileW SetLastError GetCurrentThread RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA VirtualFree CreateHardLinkW HeapAlloc ResumeThread GetStartupInfoW UnmapViewOfFile VirtualLock VirtualUnlock HeapCreate RtlAddFunctionTable ReadFile SetFilePointer RtlCompareMemory GetStdHandle GetSystemTimeAsFileTime CreateFileMappingW MapViewOfFile FormatMessageW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetCurrentDirectoryW LoadLibraryExW CreateThread TerminateThread GetTempPathW GetEnvironmentVariableW GetEnvironmentVariableA GetModuleFileNameW ExpandEnvironmentStringsW FindNextFileW GetCommandLineW CreateFileA HeapFree CreateFileMappingA SetEvent ResetEvent CreateEventA WaitForMultipleObjects SetThreadPriority GetVersionExA FormatMessageA WaitForMultipleObjectsEx SetWaitableTimer CancelWaitableTimer GetPriorityClass CreateWaitableTimerA SignalObjectAndWait GetThreadPriority GetCurrentThreadId GetLocaleInfoEx FindFirstFileExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter FindFirstFileW SizeofResource CreateDirectoryW SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetCurrentProcess WriteProcessMemory GetExitCodeProcess QueryFullProcessImageNameW CopyFileW GetModuleHandleW CreateProcessW GetCurrentProcessId ExitProcess FindResourceW LoadResource CloseHandle Process32FirstW LockResource Process32NextW GetLastError CreateToolhelp32Snapshot OpenProcess GetFileAttributesW WaitForSingleObject HeapDestroy FindClose VirtualAlloc GetFileSizeEx

user32

SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos MoveWindow SetWindowPos DefWindowProcW GetWindowRect DestroyWindow UpdateWindow CreateWindowExW ScreenToClient SendMessageW GetSystemMetrics RegisterClassExW ShowWindow DispatchMessageW TrackMouseEvent TranslateMessage LoadCursorW GetClientRect SetCapture PostQuitMessage UnregisterClassW GetAsyncKeyState PeekMessageW MessageBoxA SetLayeredWindowAttributes OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo GetCapture ClientToScreen GetKeyboardLayout GetForegroundWindow

advapi32

RegOpenKeyExW RegQueryValueExW RegSetValueExW RegEnumKeyExW RegCloseKey RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegDeleteKeyW RegCreateKeyExW RegQueryValueExA

shell32

ShellExecuteExA ShellExecuteA SHGetFolderPathW

ole32

CoTaskMemFree CoInitialize CoGetInterfaceAndReleaseStream CoMarshalInterThreadInterfaceInStream CoCreateGuid CoUninitialize CoCreateInstance CoInitializeEx PropVariantClear

avcodec-62

av_packet_alloc av_packet_free av_packet_unref avcodec_alloc_context3 avcodec_find_decoder avcodec_flush_buffers avcodec_free_context avcodec_open2 avcodec_parameters_to_context avcodec_receive_frame avcodec_send_packet

avformat-62

av_read_frame av_seek_frame avformat_close_input avformat_find_stream_info avformat_network_init avformat_open_input

avutil-60

av_channel_layout_copy av_channel_layout_default av_frame_alloc av_frame_free av_frame_get_buffer av_frame_unref av_log_set_level

swresample-6

swr_alloc_set_opts2 swr_convert_frame swr_free swr_init

swscale-9

sws_freeContext sws_getContext sws_scale

msvcp140

_Query_perf_frequency ?_Winerror_map@std@@YAHH@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Syserror_map@std@@YAPEBDH@Z _Query_perf_counter ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?set_new_handler@std@@YAP6AXXZP6AXXZ@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock _Cnd_broadcast ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?good@ios_base@std@@QEBA_NXZ

ntdll

NtQueryObject NtWaitForSingleObject NtOpenSection NtSetValueKey NtTerminateProcess RtlNtdllName NtDeviceIoControlFile RtlLengthSid RtlDosPathNameToNtPathName_U NtAlpcCreatePort NtAlpcDisconnectPort RtlDoesFileExists_U RtlExpandEnvironmentStrings NtQueryDirectoryObject NtOpenDirectoryObject RtlNtStatusToDosError NtUnmapViewOfSection RtlTimeToSecondsSince1970 NtMapViewOfSection NtOpenKey RtlSubAuthoritySid NtQuerySystemInformation NtSetSecurityObject NtDuplicateObject NtClose RtlFreeHeap RtlAdjustPrivilege RtlImageNtHeader RtlFreeAnsiString RtlInitUnicodeString RtlInitializeSid RtlLengthRequiredSid RtlAddAccessAllowedAce RtlCreateAcl RtlSetDaclSecurityDescriptor NtLoadDriver NtUnloadDriver RtlUnicodeStringToAnsiString LdrLoadDll RtlCreateSecurityDescriptor RtlEqualUnicodeString NtCreateSection LdrAccessResource LdrFindResource_U RtlInitString LdrGetProcedureAddress NtFreeVirtualMemory RtlFreeUnicodeString NtQueryInformationProcess NtOpenProcess NtAdjustPrivilegesToken NtOpenProcessToken NtFlushBuffersFile NtWriteFile NtCreateFile NtAlpcAcceptConnectPort RtlAllocateHeap RtlSetLastWin32Error NtReplyWaitReceivePort

crypt32

CryptProtectData CryptBinaryToStringA CryptUnprotectData

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

urlmon

URLDownloadToFileA

rpcrt4

UuidCreate

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiRemoveDevice SetupDiCallClassInstaller SetupDiGetINFClassW SetupDiOpenDeviceInterfaceRegKey SetupDiDestroyDeviceInfoList SetupDiCreateDeviceInfoW SetupDiCreateDeviceInfoList InstallHinfSectionW SetupDiGetClassDevsA SetupDiSetDeviceRegistryPropertyW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceAlias SetupDiGetDeviceRegistryPropertyW

newdev

UpdateDriverForPlugAndPlayDevicesW

fltlib

FilterConnectCommunicationPort FilterSendMessage

msdelta

DeltaFree ApplyDeltaB

winmm

waveOutClose waveOutGetDevCapsW waveOutUnprepareHeader timeGetTime waveOutWrite waveOutGetNumDevs waveOutPrepareHeader waveOutOpen waveOutPause timeGetDevCaps timeEndPeriod timeBeginPeriod waveInMessage waveInReset waveInStart waveInAddBuffer waveInUnprepareHeader waveInPrepareHeader waveInClose waveInOpen waveInGetErrorTextW waveInGetDevCapsW waveInGetNumDevs waveOutMessage waveOutGetPosition waveOutReset waveOutRestart waveOutGetErrorTextW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_compare __std_exception_destroy wcsstr __std_type_info_name __std_terminate _purecall __std_exception_copy strstr strchr _CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception longjmp strrchr memchr __C_specific_handler __RTDynamicCast memset memmove memcpy memcmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __p__commode _set_fmode ungetwc ungetc __stdio_common_vsprintf_s fgetc fgetwc setvbuf fgetpos __stdio_common_vsprintf fwrite fread fputc _fseeki64 __stdio_common_vswprintf __stdio_common_vfprintf_s fputwc fsetpos _get_stream_buffer_pointers __stdio_common_vfprintf __acrt_iob_func __stdio_common_vsscanf _wfopen fflush fclose fseek ftell __stdio_common_vsnprintf_s

api-ms-win-crt-heap-l1-1-0

_aligned_malloc malloc _set_new_mode _callnewh realloc _aligned_free free

api-ms-win-crt-runtime-l1-1-0

_errno _beginthreadex abort _configure_narrow_argv terminate _invalid_parameter_noinfo _initialize_narrow_environment _initialize_onexit_table _invoke_watson _register_onexit_function _crt_atexit _cexit _register_thread_local_exe_atexit_callback _c_exit _seh_filter_exe _set_app_type _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _wassert

api-ms-win-crt-string-l1-1-0

strncpy_s isdigit strncpy towlower _wcsicmp strlen strcmp wcsncpy _wcsnicmp iswctype tolower wcsncmp strncmp

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64_s

api-ms-win-crt-convert-l1-1-0

strtoll strtoull atoi strtod strtol

api-ms-win-crt-math-l1-1-0

sin sinf cosf powf cos __setusermatherr fmodf acosf _dclass roundf ceilf fmod sqrtf _dsign

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-utility-l1-1-0

qsort rand srand bsearch

Name

.text

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9.7MB

Virtual Size

9.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

30.6MB

Virtual Size

30.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=253, version=35207,

count=2, id=259, version=35207,

count=9, id=260, version=35207,

count=6, id=257, version=35207,

count=17, id=260, version=34808,

count=26, id=260, version=31107,

count=41, productName=Unmarked objects (old),

count=2, id=259, version=33145,

count=3, id=260, version=33145,

count=13, id=260, version=35228,

count=42, id=261, version=35207,

count=40, id=257, version=33145,

count=92, id=261, version=35228,

count=3, id=259, version=35228,

count=5, id=156, version=21202,

count=739, id=1, productName=Unmarked objects,

count=34, id=265, version=35228,

count=1, id=255, version=35228,

count=1, id=151,

count=1, id=258, version=35228,