General
- Target 2026-07-06_8b3b7fe7c5e82c7d9ae58cf0a64ab836_glassworm_icedid_luca-stealer_njrat_quasar-rat
- Size 33.0MB
- Sample260707-cw36laf131
- SHA256 e60e1e787cdbe9f3372daa64e7b21ede1a1b91057ebfd67b8ac7d4b819dfe49e
- MD5 8b3b7fe7c5e82c7d9ae58cf0a64ab836
- SHA1 ad153fae9615c78ed1dcde417408199ac0caae57
- SHA512 f6b653fddb476d673f2ad2f7774b1be7303fee684157fb65b15ea260f122ca078d3899af0ffb2c5c34d2a9cd974ddf6e92c29f761501ca78ee10ebc8b13d2710
- SSDEEP 786432:PIgOHN3QE8YC+iW8mS+0pb9fBjqaV+sEbnFi5buf9PP2AaxXMvH:PI/3QE8YC+iWCNpb9fEaV+BbnQbkFP22
- TLSH T103773357F76258E8C56BC1B886929732BA70B42D0634AE5B1FE4D7221F23D909F3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-06_8b3b7fe7c5e82c7d9ae58cf0a64ab836_glassworm_icedid_luca-stealer_njrat_quasar-rat.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_8b3b7fe7c5e82c7d9ae58cf0a64ab836_glassworm_icedid_luca-stealer_njrat_quasar-rat.exe
Resource
win11ltsc2024-20260706-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-06_8b3b7fe7c5e82c7d9ae58cf0a64ab836_glassworm_icedid_luca-stealer_njrat_quasar-rat
- Size 33.0MB
- SHA256 e60e1e787cdbe9f3372daa64e7b21ede1a1b91057ebfd67b8ac7d4b819dfe49e
- MD5 8b3b7fe7c5e82c7d9ae58cf0a64ab836
- SHA1 ad153fae9615c78ed1dcde417408199ac0caae57
- SHA512 f6b653fddb476d673f2ad2f7774b1be7303fee684157fb65b15ea260f122ca078d3899af0ffb2c5c34d2a9cd974ddf6e92c29f761501ca78ee10ebc8b13d2710
- SSDEEP 786432:PIgOHN3QE8YC+iW8mS+0pb9fBjqaV+sEbnFi5buf9PP2AaxXMvH:PI/3QE8YC+iWCNpb9fEaV+BbnQbkFP22
- TLSH T103773357F76258E8C56BC1B886929732BA70B42D0634AE5B1FE4D7221F23D909F3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables using Telegram Chat Bot
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL