2026-07-20_3bf7e38c82adedd37524fa0d0b83b084_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_3bf7e38c82adedd37524fa0d0b83b084_glassworm_icedid_luca-stealer_njrat_stealc
Size 6.7MB
Sample260720-l4pslsd18r
SHA256 f90f9d15913007b36b2298f48834af44d6adc3065ffe6511b6779d9953c78a1d
MD5 3bf7e38c82adedd37524fa0d0b83b084
SHA1 cd534da026002ac443d4c4e666a169ccac40751f
SHA512 bd8b50913ca1e26f9e32a4438036a708f53f7937e7f4fb9fae13e3c72a03c49b9cb7a0d7f2e79ae6b4b11c66a6e58646bf96e3f5694caad4076231b888bfcee7
SSDEEP 196608:3lplVVzY03+Iac9Wi4I+GsS/wfVu233t/8hI:zlHzY03+Iac9Wi4Is6wfg2ntUhI
TLSH
T1D1669D0367930DB9C7E2A3348F4AFD56E3B1FB0E1B2355EB1EF595113A227930A66211
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_3bf7e38c82adedd37524fa0d0b83b084_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-20_3bf7e38c82adedd37524fa0d0b83b084_glassworm_icedid_luca-stealer_njrat_stealc

.exe 6.7MB

2026-07-20_3bf7e38c82adedd37524fa0d0b83b084_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 8bc173c0bbe31fdfeeb86f361076232a
SHA256 f90f9d15913007b36b2298f48834af44d6adc3065ffe6511b6779d9953c78a1d
MD5 3bf7e38c82adedd37524fa0d0b83b084
SHA1 cd534da026002ac443d4c4e666a169ccac40751f
SHA512 bd8b50913ca1e26f9e32a4438036a708f53f7937e7f4fb9fae13e3c72a03c49b9cb7a0d7f2e79ae6b4b11c66a6e58646bf96e3f5694caad4076231b888bfcee7
SSDEEP 196608:3lplVVzY03+Iac9Wi4I+GsS/wfVu233t/8hI:zlHzY03+Iac9Wi4Is6wfg2ntUhI
TLSH
T1D1669D0367930DB9C7E2A3348F4AFD56E3B1FB0E1B2355EB1EF595113A227930A66211
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with VMProtect.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1545184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoInitialize CoUninitialize CoInitializeEx CoCreateInstance

ws2_32

getsockname socket recv htons getpeername connect closesocket bind accept WSACleanup WSAStartup ntohs WSAGetLastError WSAWaitForMultipleEvents WSAResetEvent WSACreateEvent getsockopt WSAEventSelect WSAEnumNetworkEvents send WSACloseEvent setsockopt WSASetLastError gethostname ioctlsocket sendto recvfrom htonl listen freeaddrinfo getaddrinfo select __WSAFDIsSet WSAIoctl

wldap32

ord46 ord14 ord216 ord73 ord219 ord208 ord41 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord133 ord147 ord301 ord145

crypt32

PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CryptStringToBinaryA CryptDecodeObjectEx CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptBinaryToStringA CertFindCertificateInStore CertFreeCRLContext CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertFreeCTLContext CertAddCertificateContextToStore

bcrypt

BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptGenerateKeyPair BCryptDecrypt BCryptExportKey BCryptFinalizeKeyPair BCryptDestroyKey BCryptGenRandom BCryptSetProperty

secur32

InitSecurityInterfaceW

iphlpapi

if_nametoindex

advapi32

CredDeleteW RegQueryValueExW RegCloseKey RegGetValueA CredWriteW CredReadW CredFree OpenThreadToken OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegSetValueExW RegCreateKeyW RegOpenKeyW RegEnumValueW ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExW

d3d11

D3D11CreateDevice

kernel32

InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetConsoleMode ReadConsoleW GetConsoleOutputCP SetFilePointerEx RtlUnwindEx RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx EncodePointer OutputDebugStringW ExitProcess HeapFree HeapAlloc FlushFileBuffers FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation HeapReAlloc SetStdHandle SetEndOfFile IsValidCodePage GetACP CloseHandle GetLastError Sleep CreateFileMappingW MapViewOfFile UnmapViewOfFile DeleteCriticalSection InitializeCriticalSectionEx DecodePointer CreateToolhelp32Snapshot Process32FirstW Process32NextW ExpandEnvironmentStringsW OpenProcess QueryFullProcessImageNameW GetEnvironmentVariableW MultiByteToWideChar WaitForSingleObject TerminateProcess Module32FirstW Module32NextW GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter OutputDebugStringA GetOEMCP GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetVolumeInformationA GetNativeSystemInfo GetComputerNameA HeapSetInformation SetProcessMitigationPolicy SetDefaultDllDirectories SetDllDirectoryW VirtualAlloc VirtualFree VirtualLock VirtualUnlock GetTickCount64 GetCurrentProcessId LoadLibraryW GetModuleHandleW FindResourceW LoadResource RtlVirtualUnwind LockResource GetWindowsDirectoryA GetFileAttributesA EnterCriticalSection GetCurrentProcess LeaveCriticalSection InitializeCriticalSection ResumeThread GetExitCodeProcess Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetSystemTimeAsFileTime GetSystemInfo VirtualAllocEx VirtualFreeEx Thread32Next Thread32First GetCurrentThreadId GetCurrentThread ReadFile CreateNamedPipeW TerminateThread CreateThread DuplicateHandle ResetEvent LocalFree GetTickCount GetExitCodeThread IsWow64Process GetModuleFileNameW GetFileAttributesW CreateActCtxW WriteFile GetTempPathW CreateFileW DeleteFileW GetTempFileNameW ReleaseActCtx ActivateActCtx RtlUnwind DeactivateActCtx GetSystemWow64DirectoryW GetCurrentDirectoryW GetWindowsDirectoryW WriteProcessMemory VirtualProtectEx GetThreadContext ReadProcessMemory CreateRemoteThread SetThreadContext VirtualQueryEx DeviceIoControl SuspendThread GetThreadTimes OpenThread ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageA SleepEx InitializeConditionVariable GetFullPathNameW MoveFileExW GetEnvironmentVariableA VerifyVersionInfoW GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects GetFileSizeEx WakeConditionVariable SleepConditionVariableCS WaitForSingleObjectEx GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RaiseException RtlPcToFileHeader SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive GetFileInformationByHandleEx GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose InitOnceComplete InitOnceBeginInitialize InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SizeofResource GetCommandLineA GetCommandLineW GetStartupInfoW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize WriteConsoleW GlobalAlloc GetSystemDirectoryW

user32

DrawIconEx DestroyIcon LoadImageW SetWindowRgn DispatchMessageA SetWindowLongPtrA GetWindowLongPtrA DefWindowProcA wsprintfW TranslateMessage PeekMessageA PostQuitMessage GetWindowRect GetWindowThreadProcessId UnregisterClassA DestroyWindow UpdateWindow ShowWindow SetWindowPos CreateWindowExA SystemParametersInfoA RegisterClassExA LoadIconA GetSystemMetrics LoadImageA OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW GetKeyState GetMessageExtraInfo GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos EnumWindows PostMessageW

gdi32

CreateRoundRectRgn DeleteDC SelectObject CreateCompatibleDC CreateDIBSection DeleteObject

shell32

ShellExecuteW

shlwapi

SHDeleteKeyW

d3dcompiler_47

D3DCompile

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

527KB

Virtual Size

526KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

845KB

Virtual Size

844KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_3bf7e38c82adedd37524fa0d0b83b084_glassworm_icedid_luca-stealer_njrat_stealc

ole32

ws2_32

wldap32

crypt32

bcrypt

secur32

iphlpapi

advapi32

d3d11

kernel32

user32

gdi32

shell32

shlwapi

d3dcompiler_47

imm32

generic