2026-07-08_87f2849e42d8c603a980984daddfff20_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_87f2849e42d8c603a980984daddfff20_glassworm_icedid_luca-stealer_njrat_stealc
Size 10.4MB
Sample260708-v21xjadv8l
SHA256 39d0afad834ed89376106be36222d84eb65d99bd1b154b87bcc8d31a91f7788d
MD5 87f2849e42d8c603a980984daddfff20
SHA1 dfc8d2080b6bbe478ba4a0cf9bf30aaa75a83d89
SHA512 bb75f1e2b1dd28336616fc5612aa2957da26884b3b468ba57e4c72161414b072478c2ace2e81e862e7c002938b7a69d2a3f6715083a0abbeef4d1e2194765f61
SSDEEP 196608:ONKVpO9GdqRcr25MaxaVhEL0cUHAQWnZV6R6PeBVVMYQby034VxAGmlPAqM:ONTGcRcr2SaxK20eZVi7vQu03FGm
TLSH
T19BB6DFE336E129BBC236C4F5D351762FDB1BF8650719F6A721A13399E723990B428B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_87f2849e42d8c603a980984daddfff20_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-08_87f2849e42d8c603a980984daddfff20_glassworm_icedid_luca-stealer_njrat_stealc

.exe 10.4MB

2026-07-08_87f2849e42d8c603a980984daddfff20_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 16f34c86d31a0ef01a0f6c9b70f54e3f
SHA256 39d0afad834ed89376106be36222d84eb65d99bd1b154b87bcc8d31a91f7788d
MD5 87f2849e42d8c603a980984daddfff20
SHA1 dfc8d2080b6bbe478ba4a0cf9bf30aaa75a83d89
SHA512 bb75f1e2b1dd28336616fc5612aa2957da26884b3b468ba57e4c72161414b072478c2ace2e81e862e7c002938b7a69d2a3f6715083a0abbeef4d1e2194765f61
SSDEEP 196608:ONKVpO9GdqRcr25MaxaVhEL0cUHAQWnZV6R6PeBVVMYQby034VxAGmlPAqM:ONTGcRcr2SaxK20eZVi7vQu03FGm
TLSH
T19BB6DFE336E129BBC236C4F5D351762FDB1BF8650719F6A721A13399E723990B428B01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9141140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineA WriteFile SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW DeleteFileW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetModuleHandleW RtlPcToFileHeader RtlUnwindEx GetCPInfo GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers OpenProcess GetStartupInfoW ExitProcess GetCurrentProcess GetLastError GetCommandLineW Process32NextW HeapReAlloc CreateToolhelp32Snapshot GetFileInformationByHandleEx GetModuleFileNameW CloseHandle SetFileInformationByHandle CreateFileW LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter VerSetConditionMask WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc SetStdHandle IsValidCodePage GetACP LCMapStringEx DecodePointer EncodePointer AreFileApisANSI GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW GetEnvironmentStringsW SetEndOfFile VirtualProtect GetTickCount64 HeapWalk GetProcessHeap GetTempPathW VirtualFree FindNextFileW FindFirstFileExW GetOEMCP FindClose VirtualAlloc GetCurrentThreadId SetConsoleTextAttribute AllocConsole CreateFileMappingA GetModuleFileNameA UnmapViewOfFile MapViewOfFile GetCurrentProcessId Sleep DeviceIoControl GetVolumeInformationA CreateFileA Process32FirstW GetStdHandle RaiseException RtlUnwind WriteConsoleW HeapSize GetTimeZoneInformation SetEnvironmentVariableW FreeEnvironmentStringsW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemDirectoryW LoadLibraryW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects SleepEx SetLastError FormatMessageW VerifyVersionInfoW MoveFileExW GetFileSizeEx WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead TryAcquireSRWLockExclusive FormatMessageA GetStringTypeW GetExitCodeThread LocalFree GetLocaleInfoEx GetCurrentDirectoryW

user32

GetWindowThreadProcessId OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyState GetForegroundWindow GetClientRect SetCursorPos SetCursor GetCursorPos ClientToScreen ScreenToClient LoadCursorW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow UpdateWindow EnumDisplayMonitors GetMonitorInfoW SetWindowPos MoveWindow UpdateLayeredWindow IsWindow PeekMessageW DispatchMessageW GetWindowRect FindWindowA MessageBoxW MessageBoxA

advapi32

CryptAcquireContextW CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptGetHashParam CryptCreateHash CryptHashData RegDeleteTreeW RegSetKeyValueW RegOpenKeyW RegCreateKeyW RegGetValueA RegSetValueExA RegOpenKeyExA RegEnumValueA RegCreateKeyExA LookupPrivilegeValueW SetTokenInformation RevertToSelf PrivilegeCheck GetTokenInformation DuplicateTokenEx OpenProcessToken SetThreadToken CreateProcessAsUserW QueryServiceStatusEx OpenServiceA OpenSCManagerW CloseServiceHandle RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCloseKey CryptReleaseContext

ole32

CoInitializeEx

ws2_32

send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs WSASetLastError WSAStartup WSACleanup htons setsockopt WSAIoctl __WSAFDIsSet select accept bind connect getsockname htonl listen recv socket getaddrinfo recvfrom sendto getpeername getsockopt ioctlsocket gethostname freeaddrinfo

crypt32

CertEnumCertificatesInStore CertCloseStore CryptDecodeObjectEx CertFindCertificateInStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CertFreeCertificateContext PFXImportCertStore CryptStringToBinaryW CertOpenStore

imm32

ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow ImmGetContext

ntdll

RtlInitUnicodeString RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry NtQuerySystemInformation NtQueryVirtualMemory

bcrypt

BCryptGenRandom

Name

.text

Size

8.9MB

Virtual Size

8.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

883KB

Virtual Size

884KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

550KB

Virtual Size

560KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

48KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_87f2849e42d8c603a980984daddfff20_glassworm_icedid_luca-stealer_njrat_stealc

kernel32

user32

advapi32

ole32

ws2_32

crypt32

imm32

ntdll

bcrypt

generic