2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc
Size 4.1MB
Sample260718-r2ahssg16w
SHA256 b888a6334a7be25d0baf81842d4dc491c9c212823753c0470328a00a51bcf2f4
MD5 ef66c294d7a6330f41c8695853167f58
SHA1 6c384e1ba4e023e55212747604280f94d46092c9
SHA512 d2ce08c84f61d72472b098cb9488dbb7c45f1bc7915fa9352781a79fda43106189ed93a5b339542af7406375af7d35686a5bb9a6ecd9d33ac659592665d976c8
SSDEEP 49152:6khn6i/dDo2ZPPDsCxX7JzGs/xRAh+HD7c2wX+UPsPbrJKR6sXPHdrV:xyCrzBROXhqgR6sXPHdr
TLSH
T1D916AD4A32A401F6C47FC0BACA5B8507F77574581360AAC716E4866A2FA3EF15B3F316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc

File Explorer

2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc

.exe 4.1MB

2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc

IMPHASH 0e45cc52e405eea6cfedc9495ef4fa9a
SHA256 b888a6334a7be25d0baf81842d4dc491c9c212823753c0470328a00a51bcf2f4
MD5 ef66c294d7a6330f41c8695853167f58
SHA1 6c384e1ba4e023e55212747604280f94d46092c9
SHA512 d2ce08c84f61d72472b098cb9488dbb7c45f1bc7915fa9352781a79fda43106189ed93a5b339542af7406375af7d35686a5bb9a6ecd9d33ac659592665d976c8
SSDEEP 49152:6khn6i/dDo2ZPPDsCxX7JzGs/xRAh+HD7c2wX+UPsPbrJKR6sXPHdrV:xyCrzBROXhqgR6sXPHdr
TLSH
T1D916AD4A32A401F6C47FC0BACA5B8507F77574581360AAC716E4866A2FA3EF15B3F316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1772352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegOpenKeyExA RegGetValueW CryptAcquireContextW CryptReleaseContext CryptGenRandom RegCloseKey

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlCaptureContext RtlGetLastNtStatus RtlUnwindEx

kernel32

HeapSize SetEnvironmentVariableW GetFileType GetLastError WriteConsoleW GetStdHandle GetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileExW FindNextFileW FlushFileBuffers GetDriveTypeW GetFileAttributesW GetFileInformationByHandle GetFinalPathNameByHandleW GetLongPathNameW GetVolumePathNameW ReadFile SetEndOfFile SetFileInformationByHandle SetFilePointerEx SetFileTime CloseHandle DuplicateHandle SetLastError GetCurrentProcess GetSystemInfo GetSystemTime VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameW GetProcAddress MoveFileExW SystemTimeToFileTime MultiByteToWideChar WideCharToMultiByte ExpandEnvironmentStringsW SetUnhandledExceptionFilter SetErrorMode InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcessId GetCurrentThread GetCurrentThreadId LoadLibraryExA SetConsoleCtrlHandler GetCommandLineW FindFirstFileW GetProcessTimes TerminateProcess GetSystemTimeAsFileTime GetSystemDirectoryW GetNativeSystemInfo GetModuleHandleW GetConsoleMode GetConsoleScreenBufferInfo SetConsoleTextAttribute SearchPathW WaitForSingleObject GetExitCodeProcess ResumeThread CreateProcessW CreateJobObjectW AssignProcessToJobObject SetInformationJobObject LocalFree SetProcessAffinityMask FormatMessageA K32GetProcessMemoryInfo RaiseException VirtualProtect FreeLibrary FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation GetLocaleInfoEx QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW SetStdHandle HeapValidate HeapWalk WriteFile GetCommandLineA ReadConsoleW GetConsoleOutputCP HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx HeapReAlloc GetProcessHeap HeapQueryInformation

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_ef66c294d7a6330f41c8695853167f58_glassworm_icedid_luca-stealer_njrat_poet-rat_stealc

advapi32

ntdll

kernel32

generic