2026-07-03_a2499ac66974dc6fc00af80a6dd1ce3d_glassworm_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_a2499ac66974dc6fc00af80a6dd1ce3d_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 5.8MB
Sample260703-rablsaav3x
SHA256 f37a9488f01bf5d20d7b19bddc6ef91cc71f6c0c6dbb05e98bf39679f344ffd6
MD5 a2499ac66974dc6fc00af80a6dd1ce3d
SHA1 56078f8218d9df9670d7774095e2e61662fae39e
SHA512 b03b61cc0da5d9d67b75ac3d0cc7e3cf6f72c32b68b56cfe11137afadd69cdc0ba0686695f864f3a914c77998ea24b342cd4a343a579ad18927c45bb4cce4f33
SSDEEP 49152:iwBfUAmoPzaR0iEeUitGQsPybWwoTLUqL+Xy5W3vh9nKeAC3A3TQptz:imUAxaZrUvu9nzACICJ
TLSH
T15C56E75AD6B652E1D4FAD138C223B22BFC723C5EC130671B9781AB165B36760E63E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_a2499ac66974dc6fc00af80a6dd1ce3d_glassworm_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-07-03_a2499ac66974dc6fc00af80a6dd1ce3d_glassworm_icedid_luca-stealer_njrat_stealc_vidar

.exe 5.8MB

2026-07-03_a2499ac66974dc6fc00af80a6dd1ce3d_glassworm_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 0fb82872ee76f0c509fa8fd4f883757a
SHA256 f37a9488f01bf5d20d7b19bddc6ef91cc71f6c0c6dbb05e98bf39679f344ffd6
MD5 a2499ac66974dc6fc00af80a6dd1ce3d
SHA1 56078f8218d9df9670d7774095e2e61662fae39e
SHA512 b03b61cc0da5d9d67b75ac3d0cc7e3cf6f72c32b68b56cfe11137afadd69cdc0ba0686695f864f3a914c77998ea24b342cd4a343a579ad18927c45bb4cce4f33
SSDEEP 49152:iwBfUAmoPzaR0iEeUitGQsPybWwoTLUqL+Xy5W3vh9nKeAC3A3TQptz:imUAxaZrUvu9nzACICJ
TLSH
T15C56E75AD6B652E1D4FAD138C223B22BFC723C5EC130671B9781AB165B36760E63E740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3750360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2047a_D20260612T140504\fa_rss\Release\PCAppStore.pdb

urlmon

CreateUri URLDownloadToFileW

ws2_32

WSAGetLastError recv WSAConnectByNameW WSAStartup socket send WSACleanup closesocket shutdown

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpSetOption WinHttpQueryHeaders

wininet

InternetQueryDataAvailable HttpSendRequestW HttpOpenRequestW InternetReadFile InternetOpenUrlW InternetConnectW InternetCloseHandle InternetOpenW HttpQueryInfoW InternetSetOptionW HttpAddRequestHeadersW

secur32

ApplyControlToken InitializeSecurityContextW DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW DeleteSecurityContext EncryptMessage FreeContextBuffer

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

shlwapi

PathFindFileNameW PathCreateFromUrlW PathAddBackslashW UrlCreateFromPathW AssocCreate SHCreateStreamOnFileEx PathRenameExtensionW

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

msi

ord45 ord32 ord118 ord8 ord160 ord92 ord159 ord70

kernel32

TlsGetValue TlsSetValue TlsFree CreateThread RtlUnwind InitializeCriticalSectionAndSpinCount ExitThread WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle ReadConsoleW SetFilePointerEx GetFileSizeEx IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW WideCharToMultiByte DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesExW GetFullPathNameW GetEnvironmentVariableW Sleep GetTickCount64 CreateFileW GetFileSize GetTempFileNameW ReadFile GetTempPathW GetExitCodeProcess CreateProcessW MultiByteToWideChar LoadResource LockResource SizeofResource FindResourceW SetEnvironmentVariableW SetEvent ResetEvent CreateEventW WaitForMultipleObjects GetModuleFileNameW OpenEventW GetOverlappedResult ReadDirectoryChangesW CreateMutexW ExpandEnvironmentStringsW SetCurrentDirectoryW GetLocaleInfoEx GetConsoleOutputCP CopyFileA OpenProcess IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetStdHandle GetCPInfo GetCurrentProcess RtlUnwindEx FreeLibrary LoadLibraryW SystemTimeToFileTime FileTimeToLocalFileTime LocalFree lstrcmpA FileTimeToSystemTime FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime LockFileEx UnlockFile HeapDestroy HeapCompact GetSystemInfo HeapReAlloc DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock GlobalFree LCIDToLocaleName GetUserDefaultUILanguage LoadLibraryExW CreateDirectoryW FindFirstFileExW RemoveDirectoryW CopyFileW VerSetConditionMask VerifyVersionInfoW GetSystemFirmwareTable GetCommandLineW OpenFileMappingW OpenMutexW GetUserDefaultLocaleName GetCurrentThread GetNativeSystemInfo Module32FirstW GlobalMemoryStatusEx Module32NextW GetProcessTimes SetUnhandledExceptionFilter FreeEnvironmentStringsW K32GetModuleBaseNameW K32EnumProcessModules GetEnvironmentStringsW FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType CompareStringEx RtlPcToFileHeader TerminateProcess LCMapStringEx EncodePointer SleepConditionVariableSRW WakeAllConditionVariable TlsAlloc GetEnvironmentVariableA PeekNamedPipe SystemTimeToTzSpecificLocalTime FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode WakeConditionVariable QueryPerformanceFrequency InitOnceComplete InitOnceBeginInitialize GetStringTypeW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetExitCodeThread CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW InterlockedPushEntrySList DeviceIoControl SetFileInformationByHandle RaiseException GetCurrentDirectoryW GetFileInformationByHandle GetSystemTime

user32

SetCursorPos GetWindowTextW SetWindowPos WindowFromPoint GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors GetShellWindow keybd_event GetForegroundWindow UnhookWinEvent FindWindowExW GetMessageW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow BeginPaint EnumWindows EmptyClipboard IntersectRect MonitorFromRect MonitorFromPoint GetWindowThreadProcessId GetClassNameW SendInput EndPaint IsWindowVisible DialogBoxParamW SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetClipboardData CloseClipboard OpenClipboard SetClassLongPtrW PtInRect ScreenToClient SetCapture GetCapture SetTimer IsIconic ShowWindow IsWindow GetDpiForWindow GetWindowRect SetWindowTextW SetForegroundWindow ReleaseCapture SetFocus GetWindowPlacement FlashWindowEx PostMessageW GetMonitorInfoW MonitorFromWindow EnumDisplayDevicesW EnumDisplaySettingsW ReleaseDC GetDC TrackMouseEvent ChangeWindowMessageFilterEx LoadIconW TrackPopupMenu InvalidateRect EqualRect RemoveMenu AppendMenuW InsertMenuW GetWindow LoadCursorW UnregisterClassW IsZoomed GetClientRect AdjustWindowRectEx GetCursorPos MapWindowPoints FillRect SetRectEmpty SetWindowLongW SendMessageW SetWindowLongPtrW GetMenuItemCount SetWindowPlacement EndDialog OpenIcon DestroyMenu CreatePopupMenu GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW FindWindowW UpdateWindow GetWindowLongPtrW

gdi32

CreateSolidBrush DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap BitBlt SetDeviceGammaRamp GetDeviceGammaRamp DeleteDC CreateDCW

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

EventUnregister RegNotifyChangeKeyValue RegCreateKeyExW GetUserNameW RegGetValueW EventWriteTransfer EventSetInformation EventRegister RegCloseKey RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegDeleteValueW RegSetValueExW RegEnumKeyExW

shell32

SHGetKnownFolderPath ShellExecuteW SHAppBarMessage SHQueryRecycleBinW SHEmptyRecycleBinW SHGetFolderPathW ShellExecuteExW CommandLineToArgvW Shell_NotifyIconW

ole32

CoCreateInstance CoInitialize CoInitializeSecurity CoInitializeEx OleUninitialize CoUninitialize RegisterDragDrop OleRun CreateStreamOnHGlobal CoTaskMemAlloc RevokeDragDrop CoAllowSetForegroundWindow OleInitialize CoSetProxyBlanket CoCreateFreeThreadedMarshaler CoTaskMemFree

oleaut32

VariantClear VariantChangeType SysStringLen VariantInit SysFreeString GetErrorInfo SetErrorInfo SysAllocString

iphlpapi

IcmpCreateFile GetAdaptersInfo IcmpCloseHandle

crypt32

CryptMsgOpenToDecode CryptMsgGetParam CertOpenStore CryptMsgUpdate CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CertCloseStore CryptDecodeObjectEx CryptDecodeObject CryptMsgClose

ext-ms-win-networking-wlanapi-l1-1-0

WlanEnumInterfaces WlanCloseHandle WlanOpenHandle WlanFreeMemory WlanGetAvailableNetworkList

wlanapi

WlanScan WlanAllocateMemory WlanRegisterNotification

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

bcrypt

BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptGenRandom BCryptDestroyHash BCryptHashData BCryptCreateHash

dxva2

DestroyPhysicalMonitor GetPhysicalMonitorsFromHMONITOR GetMonitorBrightness SetMonitorBrightness GetNumberOfPhysicalMonitorsFromHMONITOR

gdiplus

GdipFree GdipAlloc GdiplusShutdown GdiplusStartup GdipDeleteMatrix GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCloneImage GdipDisposeImage GdipScaleWorldTransform GdipDrawImageI GdipCreateBitmapFromHBITMAP GdipCreateMatrix GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipFlush GdipTranslateWorldTransform GdipCreateFromHDC GdipSetStringFormatAlign GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipFillEllipse

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

dbghelp

SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 SymInitialize StackWalk64 SymSetOptions SymFromAddr SymCleanup

version

GetFileVersionInfoSizeW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

974KB

Virtual Size

973KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

200KB

Virtual Size

354KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

242KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

313KB

Virtual Size

313KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_a2499ac66974dc6fc00af80a6dd1ce3d_glassworm_icedid_luca-stealer_njrat_stealc_vidar

urlmon

ws2_32

winhttp

wininet

secur32

wtsapi32

shlwapi

dwmapi

api-ms-win-shcore-scaling-l1-1-1

msi

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

crypt32

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

api-ms-win-core-version-l1-1-0

api-ms-win-core-version-l1-1-1

bcrypt

dxva2

gdiplus

setupapi

dbghelp

version

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic