2026-07-08_db48aa6d2df47152ddd5cba046ff94d8_glassworm_icedid_luca-stealer_njrat_stealc

General

Target
2026-07-08_db48aa6d2df47152ddd5cba046ff94d8_glassworm_icedid_luca-stealer_njrat_stealc
Size 8.6MB
Sample260708-ep46esbs4p
SHA256 0cc3cb320dc88a9a6f12fabeba1e4ee8b7d334a78855f4db931f8d06a06f560d
MD5 db48aa6d2df47152ddd5cba046ff94d8
SHA1 f78fb6cbacd9fe9b2b81531ca00eb88af4cda5ce
SHA512 5511852d5ab69042f83796c4171fbed836412d09b0ec67ba2f359d93f18254f4b9ed61bedbbf9a37bc55b29f4261cd145cdbcf67ac07a8c5962fafae12fc37f4
SSDEEP 49152:stye0Tp4jwWjNvI2nspwa1yIMFa69AJRGFgonV6XPj+E:GyeLwGvbFFAJYsPj+
TLSH
T11F96BF4663A601E8C6ABC13C85469717EBB17C051720DBCF27E5BB691F33AE52E3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_db48aa6d2df47152ddd5cba046ff94d8_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-08_db48aa6d2df47152ddd5cba046ff94d8_glassworm_icedid_luca-stealer_njrat_stealc

.exe 8.6MB

2026-07-08_db48aa6d2df47152ddd5cba046ff94d8_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH c4142097c16d90542d09554694df959e
SHA256 0cc3cb320dc88a9a6f12fabeba1e4ee8b7d334a78855f4db931f8d06a06f560d
MD5 db48aa6d2df47152ddd5cba046ff94d8
SHA1 f78fb6cbacd9fe9b2b81531ca00eb88af4cda5ce
SHA512 5511852d5ab69042f83796c4171fbed836412d09b0ec67ba2f359d93f18254f4b9ed61bedbbf9a37bc55b29f4261cd145cdbcf67ac07a8c5962fafae12fc37f4
SSDEEP 49152:stye0Tp4jwWjNvI2nspwa1yIMFa69AJRGFgonV6XPj+E:GyeLwGvbFFAJYsPj+
TLSH
T11F96BF4663A601E8C6ABC13C85469717EBB17C051720DBCF27E5BB691F33AE52E3A350
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

43448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FindFirstFileA HeapFree InitializeProcThreadAttributeList FindNextFileA GetEnvironmentVariableA FindClose UpdateProcThreadAttribute GetFileAttributesA Process32Next DeleteProcThreadAttributeList Process32First GetProcessHeap GetTickCount Sleep ExitProcess GetLastError GetSystemTimeAsFileTime SetEndOfFile ReadFile Module32NextW FlushInstructionCache GetModuleHandleW ReadProcessMemory GetProcAddress VirtualProtectEx Module32FirstW CloseHandle CreateToolhelp32Snapshot OpenProcess GetCurrentProcess HeapAlloc WriteProcessMemory WriteConsoleW HeapSize CreateFileW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA RtlUnwind

advapi32

ImpersonateLoggedOnUser EnumerateTraceGuidsEx DuplicateTokenEx QueryAllTracesA EnableTraceEx2 AdjustTokenPrivileges RevertToSelf CloseServiceHandle OpenSCManagerW LookupPrivilegeValueA OpenProcessToken OpenServiceW QueryServiceStatusEx

shell32

SHGetFolderPathW

ole32

StringFromGUID2

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_db48aa6d2df47152ddd5cba046ff94d8_glassworm_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

shell32

ole32

generic