2026-11-11_14dae1f0e9cf80220f3ec9e6b0f11205_coinminer_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_14dae1f0e9cf80220f3ec9e6b0f11205_coinminer_glassworm_icedid_njrat
Size 7.5MB
Sample261113-vhn4mayt3m
SHA256 f69fb93307a0eea75775d18a613384c863470e5e055a7ea2af644b65ad40af4e
MD5 14dae1f0e9cf80220f3ec9e6b0f11205
SHA1 1f2976d94dcd770b3389efb48e7cfaa9c15bf47f
SHA512 f7c07e9372f7530d91d4415a113cf53514f8d917c09c22e0f8c40cabe11bff22fad914135bff215979d4e364de850d43ab7577aec6c2022f9d31245b69f67fd0
SSDEEP 98304:d7spcIvj2B2zm0I5l50QDZRAJ6RuvFBJiz:dspcIvj2B2zm0KKFq
TLSH
T126860647B7B621D0E4BAC2399253632BF9B138AA833497C74645465A0F33BF4AD3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_14dae1f0e9cf80220f3ec9e6b0f11205_coinminer_glassworm_icedid_njrat

File Explorer

2026-11-11_14dae1f0e9cf80220f3ec9e6b0f11205_coinminer_glassworm_icedid_njrat

.exe 7.5MB

2026-11-11_14dae1f0e9cf80220f3ec9e6b0f11205_coinminer_glassworm_icedid_njrat

IMPHASH 58025b67988de70f02baed9160552428
SHA256 f69fb93307a0eea75775d18a613384c863470e5e055a7ea2af644b65ad40af4e
MD5 14dae1f0e9cf80220f3ec9e6b0f11205
SHA1 1f2976d94dcd770b3389efb48e7cfaa9c15bf47f
SHA512 f7c07e9372f7530d91d4415a113cf53514f8d917c09c22e0f8c40cabe11bff22fad914135bff215979d4e364de850d43ab7577aec6c2022f9d31245b69f67fd0
SSDEEP 98304:d7spcIvj2B2zm0I5l50QDZRAJ6RuvFBJiz:dspcIvj2B2zm0KKFq
TLSH
T126860647B7B621D0E4BAC2399253632BF9B138AA833497C74645465A0F33BF4AD3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56026

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmGetColorizationColor DwmEnableBlurBehindWindow DwmIsCompositionEnabled

winmm

timeBeginPeriod timeEndPeriod

shell32

SHGetKnownFolderPath

ole32

CoUninitialize CoInitializeEx CoSetProxyBlanket CoCreateInstance CoTaskMemFree

kernel32

LocalFree FormatMessageA VerifyVersionInfoW WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive CreateThread GetTickCount64 CreateFileW WriteFile OutputDebugStringA ReleaseSRWLockShared AcquireSRWLockShared GetCurrentProcess GetCurrentThreadId FlushInstructionCache GetLocalTime VirtualAlloc VirtualFree VirtualLock VirtualUnlock GetModuleHandleA GetEnvironmentVariableA SwitchToThread SetPriorityClass CreateToolhelp32Snapshot Process32FirstW Process32NextW GetVolumeInformationA GetComputerNameW GetTickCount GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency LoadLibraryA GetSystemTime SystemTimeToFileTime GetStdHandle GetFileType OutputDebugStringW SwitchToFiber DeleteFiber CreateFiber FindClose FindFirstFileW FindNextFileW FormatMessageW ConvertFiberToThread ConvertThreadToFiber GetSystemTimeAsFileTime GetCurrentProcessId GlobalMemoryStatus GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber GetTempPathW HeapQueryInformation HeapReAlloc GetCurrentThread GetCommandLineW GetCommandLineA WaitForSingleObject SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW ExitProcess ReadFile SetConsoleCtrlHandler FreeLibraryAndExitThread ResumeThread ExitThread WriteConsoleW GetModuleHandleExW GetSystemInfo SetWaitableTimer GetModuleHandleW LoadLibraryExW LoadLibraryW RtlUnwindEx RtlPcToFileHeader InterlockedFlushSList InterlockedPushEntrySList VirtualQuery GetProcessHeap HeapFree HeapAlloc RaiseException InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext ResetEvent GetCPInfo CompareStringEx GetLocaleInfoEx LCMapStringEx DecodePointer EncodePointer CreateSymbolicLinkW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc SetEvent DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort SetLastError GetLastError CloseHandle VerSetConditionMask GetConsoleOutputCP RtlUnwind GetFileSizeEx SetFilePointerEx SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW SetStdHandle GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetFileInformationByHandleEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable InitOnceExecuteOnce FlsFree FlsSetValue FlsGetValue FlsAlloc SetFileInformationByHandle GetStringTypeW GetNativeSystemInfo GetExitCodeThread WaitForSingleObjectEx TryEnterCriticalSection InitializeCriticalSectionEx InitializeSRWLock CreateEventW GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetEndOfFile GetModuleFileNameW GetProcAddress TerminateThread QueueUserAPC CreateWaitableTimerW WaitForMultipleObjects HeapSize Sleep HeapValidate SleepEx FileTimeToSystemTime

user32

SetWindowPos SetFocus GetAsyncKeyState GetForegroundWindow SetForegroundWindow PeekMessageA DefWindowProcA RegisterClassExA CreateWindowExA SetLayeredWindowAttributes ShowWindow UpdateWindow GetClientRect GetWindowRect SetCursor ClientToScreen GetWindow LoadCursorA mouse_event DestroyWindow DispatchMessageA TranslateMessage GetSystemMetrics IsWindow FindWindowA GetCapture OpenClipboard MessageBoxW GetUserObjectInformationW GetProcessWindowStation SetProcessDPIAware EnumDisplayMonitors GetMonitorInfoW MonitorFromWindow LoadCursorW SetWindowLongW GetWindowLongW WindowFromPoint ScreenToClient GetCursorPos SetCursorPos AdjustWindowRectEx SetWindowTextW ReleaseDC GetDC ReleaseCapture SetCapture CloseClipboard GetKeyState BringWindowToTop IsIconic IsChild CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData

gdi32

CreateRectRgn DeleteObject GetDeviceCaps GetStockObject

comdlg32

GetSaveFileNameA GetOpenFileNameA

advapi32

CryptGetProvParam RegCloseKey RegOpenKeyExW RegQueryValueExW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptSetHashParam CryptDestroyKey CryptReleaseContext

oleaut32

SysStringLen SafeArrayGetElement GetErrorInfo VariantInit VariantChangeType SetErrorInfo CreateErrorInfo SysAllocString SafeArrayGetVartype VariantClear SysFreeString

ws2_32

bind closesocket connect ioctlsocket getsockname getsockopt htonl listen ntohl select setsockopt WSAStartup WSACleanup WSASetLastError accept WSAIoctl WSARecv WSASend WSASocketW WSAAddressToStringW getaddrinfo freeaddrinfo recv send htons inet_ntoa ntohs gethostbyname getservbyname __WSAFDIsSet getnameinfo socket WSAGetLastError

iphlpapi

GetAdaptersInfo

imm32

ImmReleaseContext ImmAssociateContextEx ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

crypt32

CertFreeCertificateContext CertCloseStore CertFindCertificateInStore CertGetCertificateContextProperty CertEnumCertificatesInStore CertDuplicateCertificateContext CertOpenStore

Name

.text

Size

5.8MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

166KB

Virtual Size

330KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

283KB

Virtual Size

282KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_c

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_d

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_14dae1f0e9cf80220f3ec9e6b0f11205_coinminer_glassworm_icedid_njrat

d3d11

dwmapi

winmm

shell32

ole32

kernel32

user32

gdi32

comdlg32

advapi32

oleaut32

ws2_32

iphlpapi

imm32

d3dcompiler_47

crypt32

generic