2026-05-19_b4b107e8908bf3195c09eea40316d713_glassworm_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-19_b4b107e8908bf3195c09eea40316d713_glassworm_icedid_luca-stealer_njrat
Size 17.1MB
Sample260519-3apdesdw21
SHA256 13094fa63e8ec29f00a1e289b9402b1e4a37767ee7b9e0ef293fd37b06d59de9
MD5 b4b107e8908bf3195c09eea40316d713
SHA1 f2db41220ef9b00b6cf2e6c2bd1fce1d37926762
SHA512 4a69b3e1c5870fd144b4751204444c73fa92fdb3a73470f4d394af8d2aca12bb3c0a2dcca0bb01768f9261e049384011d746691f2b7cc082b62d47e6fcca0021
SSDEEP 196608:wMAC2VdK3x70jl9HJhVSr4nGcTv2fuFQS5zIF2YIVdUG/1pX8kk5s4wwTJRsgKmw:wM6bK6LJ2kGcT2CdU4pxkO4ws817
TLSH
T1AD0733D7F63807A8D3A360B94C392683CA779C145754D84B3762BDDAAB1A9F2192D303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-05-19_b4b107e8908bf3195c09eea40316d713_glassworm_icedid_luca-stealer_njrat

.exe 17.1MB

2026-05-19_b4b107e8908bf3195c09eea40316d713_glassworm_icedid_luca-stealer_njrat

IMPHASH b55ca6c882b88846acd2377217f25928
SHA256 13094fa63e8ec29f00a1e289b9402b1e4a37767ee7b9e0ef293fd37b06d59de9
MD5 b4b107e8908bf3195c09eea40316d713
SHA1 f2db41220ef9b00b6cf2e6c2bd1fce1d37926762
SHA512 4a69b3e1c5870fd144b4751204444c73fa92fdb3a73470f4d394af8d2aca12bb3c0a2dcca0bb01768f9261e049384011d746691f2b7cc082b62d47e6fcca0021
SSDEEP 196608:wMAC2VdK3x70jl9HJhVSr4nGcTv2fuFQS5zIF2YIVdUG/1pX8kk5s4wwTJRsgKmw:wM6bK6LJ2kGcT2CdU4pxkO4ws817
TLSH
T1AD0733D7F63807A8D3A360B94C392683CA779C145754D84B3762BDDAAB1A9F2192D303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

1d:58:35:8f:c0:de:73:c7:fd:a4:67:8f:33:ba:9f:60:e7:25:a6:c7:ce:a1:06:9a:84:d5:f0:52:65:66:f0:f1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=2083823,CN=Lynx Studio Technology\, Inc.,O=Lynx Studio Technology\, Inc.,L=Costa Mesa,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 21, 2025

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2021 - Dec 29, 2040

Subject

Serial Number

af:a6:d7:7f:94:4d:7c:47:d1:6b:0a:39:0e:b0:56:02

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 19, 2025 - Feb 19, 2027

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

20820

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

setupapi

SetupDiSetDeviceRegistryPropertyA SetupDiGetClassDevsA SetupDiGetDeviceRegistryPropertyA CM_Locate_DevNodeA SetupInstallFromInfSectionA SetupCloseInfFile CM_Reenumerate_DevNode SetupOpenInfFileA SetupDiEnumDeviceInfo

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

lz32

LZClose LZOpenFileA LZCopy

comctl32

InitCommonControlsEx

crypt32

CryptQueryObject CertAddCertificateContextToStore CertCloseStore CertFreeCertificateContext CertOpenStore

kernel32

LoadResource LockResource FreeResource SizeofResource GetModuleFileNameA GetLocalTime HeapAlloc GetProcessHeap HeapFree GetComputerNameA GetVersionExA GetSystemInfo GlobalMemoryStatus GetTempPathA CreateDirectoryA GetCurrentDirectoryA LoadLibraryA FreeLibrary RemoveDirectoryA EnumResourceNamesA CreateFileA WriteFile CloseHandle lstrcpyA SetFileAttributesA FormatMessageA LocalFree SystemTimeToFileTime LocalFileTimeToFileTime SetFileTime GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetLastError GetCurrentProcess GetModuleHandleA GetProcAddress GetWindowsDirectoryA DeleteFileA lstrlenA FindResourceA OutputDebugStringA MultiByteToWideChar FindFirstFileA FindClose GetACP GetSystemDirectoryA GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW GetFileSizeEx SetFilePointerEx CreateFileW ReadFile ReadConsoleW HeapSize HeapReAlloc SetEndOfFile WriteConsoleW GetFileAttributesA GetFileType GetModuleHandleExW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW ExitProcess

user32

wsprintfA SendMessageA GetWindowTextA CreateDialogParamA GetWindow GetTopWindow CharNextA DispatchMessageA TranslateMessage PeekMessageA ShowWindow UpdateWindow GetMessageA IsDialogMessageA PostQuitMessage SetWindowTextA SetDlgItemTextA GetDlgItem EndDialog MessageBoxA SetCursor LoadCursorA GetWindowTextLengthA

advapi32

GetUserNameA RegCloseKey RegQueryValueExA RegOpenKeyExA InitiateSystemShutdownA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

ole32

CoCreateInstance CoInitialize

Name

.text

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16.9MB

Virtual Size

16.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-19_b4b107e8908bf3195c09eea40316d713_glassworm_icedid_luca-stealer_njrat

setupapi

version

lz32

comctl32

crypt32

kernel32

user32

advapi32

ole32

generic