2026-07-09_36247bbf52ed3fbcbbd0d3af6f814e8e_glassworm_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_36247bbf52ed3fbcbbd0d3af6f814e8e_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 5.9MB
Sample260709-csf7nacy4s
SHA256 73bb78bc07aafa07c53f221b27a920f4e6d4159a94ff1e4cd36a0233df5dd101
MD5 36247bbf52ed3fbcbbd0d3af6f814e8e
SHA1 09b83a0926a93418edba70e07e7c95a331966295
SHA512 c3edf811e464d2679f4973d7dbe4f284f087192fbc295801fcd1ec55b0cd28cdaa13953ebc6f1f3d0f8db7cf8a0531a9c8eee06f5eb64a49a3a3506cf7fc0030
SSDEEP 98304:OWPiLTwiJCaX5Dfi1IrMINR/jeRBSm2sWd8HJsCtrzfX:taTwiJCaX5DfurINR/CBT2sEOJs
TLSH
T109569D4BB3A401ECC17BD178CA175A17E7B1344903305AEB17A086A52F63BE5AB7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_36247bbf52ed3fbcbbd0d3af6f814e8e_glassworm_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-07-09_36247bbf52ed3fbcbbd0d3af6f814e8e_glassworm_icedid_luca-stealer_njrat_stealc_vidar

.exe 5.9MB

2026-07-09_36247bbf52ed3fbcbbd0d3af6f814e8e_glassworm_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH bb86d3aedc089bdf5361404d0d65b2e2
SHA256 73bb78bc07aafa07c53f221b27a920f4e6d4159a94ff1e4cd36a0233df5dd101
MD5 36247bbf52ed3fbcbbd0d3af6f814e8e
SHA1 09b83a0926a93418edba70e07e7c95a331966295
SHA512 c3edf811e464d2679f4973d7dbe4f284f087192fbc295801fcd1ec55b0cd28cdaa13953ebc6f1f3d0f8db7cf8a0531a9c8eee06f5eb64a49a3a3506cf7fc0030
SSDEEP 98304:OWPiLTwiJCaX5Dfi1IrMINR/jeRBSm2sWd8HJsCtrzfX:taTwiJCaX5DfurINR/CBT2sEOJs
TLSH
T109569D4BB3A401ECC17BD178CA175A17E7B1344903305AEB17A086A52F63BE5AB7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables (downlaoders) containing URLs to raw contents of a paste
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

762640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\V4ROil\Downloads\New folder\ViperXereca Loader Cmd\ViperXereca Loader Cmd\EXe\ViperXereca Loader.pdb

kernel32

VirtualAllocEx GetProcAddress AddVectoredExceptionHandler HeapDestroy Beep HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection CreateThread VirtualProtect CreateFileMappingW GetModuleFileNameA GetModuleFileNameW QueryFullProcessImageNameW SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree QueryPerformanceFrequency GetSystemDirectoryW FreeLibrary LoadLibraryW SleepEx GetSystemInfo QueryPerformanceCounter GetTickCount WideCharToMultiByte WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId VerifyVersionInfoW SystemTimeToFileTime SleepConditionVariableSRW GetCurrentThreadId CreateFileMappingA GetModuleHandleW GetConsoleWindow CreateRemoteThread CreateDirectoryA MapViewOfFile GetLastError IsDebuggerPresent FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW SetFileAttributesA FindResourceW LoadResource CloseHandle GetFileSizeEx Process32FirstW DeleteFileW DeleteFileA LockResource GetCurrentThread Process32NextW Sleep MultiByteToWideChar CreateToolhelp32Snapshot SetFileAttributesW OpenProcess GetModuleHandleA UnmapViewOfFile GetFileAttributesW CreateFileW WaitForSingleObject SetFileTime TerminateProcess WriteFile GetStdHandle GetCurrentProcess SetConsoleTitleA SetConsoleTextAttribute WriteProcessMemory MoveFileExW SizeofResource

user32

SendMessageW MessageBoxA LoadIconW

advapi32

CryptEncrypt CryptDestroyKey SystemFunction036 CheckTokenMembership FreeSid RegSetValueExA RegCreateKeyExA AllocateAndInitializeSid InitializeAcl IsValidSid SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData RegDeleteKeyA RegCloseKey CryptImportKey CryptDestroyHash OpenProcessToken AddAccessAllowedAce GetLengthSid GetTokenInformation

shell32

ShellExecuteW ShellExecuteA

msvcp140

?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Xbad_function_call@std@@YAXXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ??7ios_base@std@@QEBA_NXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Xtime_get_ticks ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Xinvalid_argument@std@@YAXPEBD@Z _Query_perf_frequency ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??1_Lockit@std@@QEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z

ntdll

VerSetConditionMask

urlmon

URLDownloadToFileW

wininet

InternetCloseHandle InternetOpenUrlW InternetOpenW InternetReadFile

crypt32

CertFreeCertificateChainEngine CryptDecodeObjectEx CertCreateCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertGetNameStringW CertFindExtension CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptQueryObject CertAddCertificateContextToStore

ws2_32

inet_ntop WSAStartup WSACleanup bind WSASetLastError connect WSAEventSelect getpeername getsockname htons recv setsockopt ntohs inet_pton WSAIoctl __WSAFDIsSet select accept htonl listen getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname WSAGetLastError WSAEnumNetworkEvents closesocket WSACreateEvent WSACloseEvent WSAWaitForMultipleEvents send socket getsockopt WSAResetEvent

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strrchr memmove strstr memcmp strchr _CxxThrowException __C_specific_handler __std_terminate __std_exception_destroy memchr memset wcschr __current_exception memcpy __std_exception_copy __current_exception_context

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _beginthreadex _invalid_parameter_noinfo_noreturn _crt_atexit terminate _seh_filter_exe _errno _set_app_type exit _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _get_initial_narrow_environment system abort _invalid_parameter_noinfo _initterm _initterm_e _exit _invoke_watson _resetstkoflw __p___argc __sys_errlist __sys_nerr _cexit _register_thread_local_exe_atexit_callback _c_exit __p___argv

api-ms-win-crt-stdio-l1-1-0

_read _set_fmode _fileno _close __acrt_iob_func __p__commode __stdio_common_vsprintf _popen fputc fsetpos _pclose fflush fclose fgetc _get_stream_buffer_pointers _fseeki64 fgets fwrite fgetpos fread _lseeki64 ungetc _write fputs _wfopen _wopen feof __stdio_common_vsscanf fseek ftell setvbuf

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode malloc calloc _callnewh free

api-ms-win-crt-string-l1-1-0

strcmp strcpy_s _wcsicmp strncmp strcspn wcspbrk wcsncmp strpbrk wcsncpy strspn _wcsdup _strdup

api-ms-win-crt-environment-l1-1-0

getenv _putenv _putenv_s

api-ms-win-crt-filesystem-l1-1-0

_unlink _unlock_file _fstat64 _wstat64 _lock_file

api-ms-win-crt-math-l1-1-0

_dclass __setusermatherr _dsign _fdopen

api-ms-win-crt-convert-l1-1-0

atoi strtod strtol strtoul strtoull strtoll wcstombs

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64 strftime _localtime64

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-crt-utility-l1-1-0

qsort

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_36247bbf52ed3fbcbbd0d3af6f814e8e_glassworm_icedid_luca-stealer_njrat_stealc_vidar

kernel32

user32

advapi32

shell32

msvcp140

ntdll

urlmon

wininet

crypt32

ws2_32

shlwapi

psapi

userenv

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic