2026-07-05_f2ebbc9240f995cf8ee8f354b725aab4_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_f2ebbc9240f995cf8ee8f354b725aab4_glassworm_icedid_luca-stealer_njrat_stealc
Size 1.5MB
Sample260705-bd7wdsfx8x
SHA256 c1cd3f8dab08dc1ad7d5f537e7ea7439167442a7b2f929d106be7b29c276b895
MD5 f2ebbc9240f995cf8ee8f354b725aab4
SHA1 d9f74af3f7cb28b5ef6c6cfd2b63ed71b72ca859
SHA512 fe40f71d7ad0858dbed9bf7fada9e152797f753ddd463a10580f3f864f36d01ee2b2e2071f411c114f12d2ff9dd14181b4d3cb204c106066a705e96ff5677073
SSDEEP 24576:vn/sQAp93yqcJqnPJo8h/yOEzgPNgg8qz8GS+SrihH1nxeMYSCamOYQFDat8p0:vncyqwquXzgigd8ESrexhY+mKFWSp
TLSH
T1BA758F47E6B401F8D0A7C278CD565A07D7B274051B74ABDF16D08AAA6F23EE11B7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_f2ebbc9240f995cf8ee8f354b725aab4_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-05_f2ebbc9240f995cf8ee8f354b725aab4_glassworm_icedid_luca-stealer_njrat_stealc

.exe 1.5MB

2026-07-05_f2ebbc9240f995cf8ee8f354b725aab4_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH f6a1a129f4c095d76ad147868d395b3c
SHA256 c1cd3f8dab08dc1ad7d5f537e7ea7439167442a7b2f929d106be7b29c276b895
MD5 f2ebbc9240f995cf8ee8f354b725aab4
SHA1 d9f74af3f7cb28b5ef6c6cfd2b63ed71b72ca859
SHA512 fe40f71d7ad0858dbed9bf7fada9e152797f753ddd463a10580f3f864f36d01ee2b2e2071f411c114f12d2ff9dd14181b4d3cb204c106066a705e96ff5677073
SSDEEP 24576:vn/sQAp93yqcJqnPJo8h/yOEzgPNgg8qz8GS+SrihH1nxeMYSCamOYQFDat8p0:vncyqwquXzgigd8ESrexhY+mKFWSp
TLSH
T1BA758F47E6B401F8D0A7C278CD565A07D7B274051B74ABDF16D08AAA6F23EE11B7E320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1108496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReadData WinHttpConnect WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpQueryDataAvailable

crypt32

CryptUnprotectData

advapi32

RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegEnumValueW GetUserNameW RegCloseKey

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptImportKey BCryptSetProperty BCryptDecrypt

ole32

CoSetProxyBlanket CoInitializeEx CoUninitialize CoCreateInstance CoTaskMemFree

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

shell32

SHGetKnownFolderPath

iphlpapi

GetAdaptersAddresses

ntdll

RtlUnwind RtlUnwindEx NtProtectVirtualMemory RtlPcToFileHeader NtQueryInformationProcess

ws2_32

inet_ntop

user32

CloseClipboard OpenClipboard GetClipboardData

kernel32

WriteConsoleW GetModuleHandleExW GetStdHandle ExitProcess GetFileType GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue SetStdHandle GetSystemInfo GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError CreateDirectoryW GetModuleFileNameW GetTempPathW CreateMutexW ReleaseMutex SetFileAttributesW GetTickCount64 GetLastError CloseHandle IsDebuggerPresent LocalFree GlobalLock GlobalUnlock MultiByteToWideChar GetFileSizeEx GetCurrentProcess WriteFile GetEnvironmentVariableW CreateFileW DeleteFileW GetProcAddress SetFilePointerEx GetComputerNameW GetModuleHandleW WideCharToMultiByte CheckRemoteDebuggerPresent FlushFileBuffers ReadFile GetFileSize CopyFileW VirtualProtect UnmapViewOfFile Sleep GetCurrentThread QueryPerformanceFrequency CreateFileMappingW MapViewOfFile QueryPerformanceCounter AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx WaitForSingleObject GetFileAttributesW GetCurrentThreadId HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA HeapReAlloc RaiseException LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile LockFileEx DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary GetSystemTimeAsFileTime GetSystemTime FormatMessageA GetTickCount GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW WakeAllConditionVariable InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess FlsFree

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_f2ebbc9240f995cf8ee8f354b725aab4_glassworm_icedid_luca-stealer_njrat_stealc

winhttp

crypt32

advapi32

bcrypt

ole32

oleaut32

shell32

iphlpapi

ntdll

ws2_32

user32

kernel32

generic