2026-06-28_3af1a2cae7e4156e24d49cadd35d8fae_glassworm_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-28_3af1a2cae7e4156e24d49cadd35d8fae_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 5.4MB
Sample260628-285mmags5x
SHA256 57d2c47dc5edb51d4a2735d70aec25a7aad4e04c84d39c369a0718ad4b4e4ac6
MD5 3af1a2cae7e4156e24d49cadd35d8fae
SHA1 b3521d7c28f6e0e9178fd8d134bf27129343653a
SHA512 c85ab4def3c5c6ba5f88ccb2cafffd5824df9a74e9af7c93f792849686e8e0e43025be1ca7a7cac3189f771768b9c090e00aea31f93f4cc99346c74704ed973f
SSDEEP 49152:vxAgBDmk2c+G8tZDTnFpRW3B7mhGXu3dceaWgN3TQpta:pAQ7M9FxwBW4CI
TLSH
T11A46E75ADA7651E5D4FAD039C227B22BFC713C5EC130A7079741AB275B36B60EA2E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_3af1a2cae7e4156e24d49cadd35d8fae_glassworm_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-06-28_3af1a2cae7e4156e24d49cadd35d8fae_glassworm_icedid_luca-stealer_njrat_stealc_vidar

.exe 5.4MB

2026-06-28_3af1a2cae7e4156e24d49cadd35d8fae_glassworm_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 643afba65450ae1ed9e778497df91dc0
SHA256 57d2c47dc5edb51d4a2735d70aec25a7aad4e04c84d39c369a0718ad4b4e4ac6
MD5 3af1a2cae7e4156e24d49cadd35d8fae
SHA1 b3521d7c28f6e0e9178fd8d134bf27129343653a
SHA512 c85ab4def3c5c6ba5f88ccb2cafffd5824df9a74e9af7c93f792849686e8e0e43025be1ca7a7cac3189f771768b9c090e00aea31f93f4cc99346c74704ed973f
SSDEEP 49152:vxAgBDmk2c+G8tZDTnFpRW3B7mhGXu3dceaWgN3TQpta:pAQ7M9FxwBW4CI
TLSH
T11A46E75ADA7651E5D4FAD039C227B22BFC713C5EC130A7079741AB275B36B60EA2E700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3494232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2044c_D20260430T173049\fa_rss\Release\PCAppStore.pdb

urlmon

URLDownloadToFileW CreateUri

ws2_32

shutdown WSAGetLastError WSAStartup send recv socket WSACleanup closesocket WSAConnectByNameW

winhttp

WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpSetOption WinHttpReadData WinHttpQueryHeaders

wininet

InternetConnectW InternetCloseHandle HttpSendRequestW HttpQueryInfoW InternetOpenW InternetQueryDataAvailable HttpOpenRequestW InternetSetOptionW InternetReadFile HttpAddRequestHeadersW

secur32

ApplyControlToken InitializeSecurityContextW DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW DeleteSecurityContext EncryptMessage FreeContextBuffer

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

shlwapi

PathFindFileNameW PathCreateFromUrlW PathAddBackslashW UrlCreateFromPathW AssocCreate SHCreateStreamOnFileEx PathRenameExtensionW

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

msi

ord70 ord45 ord32 ord118 ord8 ord160 ord92 ord159

kernel32

EncodePointer LCMapStringEx CompareStringEx IsProcessorFeaturePresent InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCPInfo RtlUnwind CreateThread RtlUnwindEx WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle ReadConsoleW SetFilePointerEx GetFileSizeEx DeleteFileW IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW WideCharToMultiByte LoadResource LockResource SizeofResource FindResourceW SetEnvironmentVariableW SetEvent ResetEvent CreateEventW Sleep WaitForMultipleObjects GetModuleFileNameW CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW CreateMutexW ExpandEnvironmentStringsW GetEnvironmentVariableW GetTickCount64 SetCurrentDirectoryW ReadFile CreateProcessW GetLocaleInfoEx GetConsoleOutputCP CopyFileA OpenProcess IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetStdHandle GetEnvironmentVariableA FindClose FindFirstFileW GetCurrentProcess GetSystemTime FreeLibrary LoadLibraryW GetStartupInfoW FileTimeToLocalFileTime LocalFree lstrcmpA FileTimeToSystemTime FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize RtlPcToFileHeader UnlockFile HeapDestroy HeapCompact GetSystemInfo HeapReAlloc DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock GlobalFree LoadLibraryExW CreateDirectoryW FindFirstFileExW FindNextFileW RemoveDirectoryW GetUserDefaultUILanguage LCIDToLocaleName VerSetConditionMask VerifyVersionInfoW GetSystemFirmwareTable GetCommandLineW OpenFileMappingW OpenMutexW Thread32Next Thread32First SuspendThread ResumeThread GetThreadContext OpenThread SetUnhandledExceptionFilter FreeEnvironmentStringsW K32GetModuleBaseNameW K32EnumProcessModules GetEnvironmentStringsW ExitThread FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType PeekNamedPipe SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable QueryPerformanceFrequency UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead TerminateProcess SystemTimeToTzSpecificLocalTime FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode InitOnceComplete InitOnceBeginInitialize GetStringTypeW GetFileInformationByHandleEx SetFileInformationByHandle RaiseException GetExitCodeThread ReleaseSRWLockExclusive LockFileEx AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW GetFileInformationByHandle SystemTimeToFileTime

user32

SetCursorPos GetWindowTextW SetWindowPos GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnumChildWindows WindowFromPoint keybd_event GetForegroundWindow UnhookWinEvent FindWindowExW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow BeginPaint EndPaint InvalidateRect ScreenToClient TrackMouseEvent IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors EqualRect FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect MonitorFromPoint GetWindowThreadProcessId ChangeWindowMessageFilterEx LoadIconW TrackPopupMenu RemoveMenu AppendMenuW InsertMenuW GetMenuItemCount DestroyMenu GetClassNameW ReleaseDC GetDC SendInput EndDialog IsWindowVisible DialogBoxParamW SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer SetForegroundWindow SetFocus IsIconic ShowWindow IsWindow GetWindowRect ReleaseCapture PostMessageW CreatePopupMenu GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW UpdateWindow GetWindow LoadCursorW MonitorFromWindow UnregisterClassW GetWindowPlacement SetWindowLongPtrW SetWindowPlacement OpenIcon GetShellWindow EmptyClipboard SetClipboardData GetDpiForWindow CloseClipboard OpenClipboard SetClassLongPtrW PtInRect SetCapture EnumWindows GetCapture GetWindowLongPtrW SetWindowLongW SetRectEmpty FillRect MapWindowPoints IsZoomed GetClientRect GetCursorPos SetWindowTextW AdjustWindowRectEx

gdi32

DeleteObject SelectObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateSolidBrush

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

RegCreateKeyExW RegNotifyChangeKeyValue GetUserNameW RegGetValueW EventUnregister RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW EventRegister EventSetInformation EventWriteTransfer

shell32

ShellExecuteW SHAppBarMessage SHGetKnownFolderPath SHQueryRecycleBinW SHEmptyRecycleBinW SHGetFolderPathW ShellExecuteExW CommandLineToArgvW Shell_NotifyIconW

ole32

CoCreateInstance RegisterDragDrop CoInitializeSecurity CoTaskMemFree CoUninitialize CoInitialize OleRun OleUninitialize CoSetProxyBlanket CreateStreamOnHGlobal CoTaskMemAlloc RevokeDragDrop CoAllowSetForegroundWindow OleInitialize CoCreateFreeThreadedMarshaler CoInitializeEx

oleaut32

VariantInit VariantChangeType SysStringLen VariantClear SysFreeString GetErrorInfo SetErrorInfo SysAllocString

iphlpapi

IcmpCloseHandle IcmpCreateFile

crypt32

CryptDecodeObjectEx CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CertCloseStore CertOpenStore CryptDecodeObject CryptMsgOpenToDecode CryptMsgClose CryptMsgUpdate CryptMsgGetParam

ext-ms-win-networking-wlanapi-l1-1-0

WlanFreeMemory WlanGetAvailableNetworkList WlanEnumInterfaces WlanOpenHandle WlanCloseHandle

wlanapi

WlanAllocateMemory WlanRegisterNotification WlanScan

bcrypt

BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptGenRandom BCryptHashData BCryptCreateHash BCryptDestroyHash

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

gdiplus

GdipCloneImage GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDeleteMatrix GdipCreateMatrix GdipFree GdipAlloc GdipCreateBitmapFromHBITMAP GdiplusStartup GdipFlush GdipDrawImageI GdipCreateFromHDC GdipDisposeImage GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdiplusShutdown GdipFillEllipse GdipSetStringFormatAlign

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

dbghelp

SymCleanup SymGetModuleBase64 SymGetModuleInfo64 SymGetLineFromAddr64 SymFunctionTableAccess64 SymInitialize StackWalk64 SymFromAddr SymSetOptions

version

GetFileVersionInfoSizeW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

895KB

Virtual Size

895KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

191KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

215KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

313KB

Virtual Size

313KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_3af1a2cae7e4156e24d49cadd35d8fae_glassworm_icedid_luca-stealer_njrat_stealc_vidar

urlmon

ws2_32

winhttp

wininet

secur32

wtsapi32

shlwapi

dwmapi

api-ms-win-shcore-scaling-l1-1-1

msi

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

crypt32

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

bcrypt

api-ms-win-core-version-l1-1-0

api-ms-win-core-version-l1-1-1

gdiplus

setupapi

dbghelp

version

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic