2026-07-20_ebf61149223e62c18825890bdf60a7ce_glassworm_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_ebf61149223e62c18825890bdf60a7ce_glassworm_icedid_njrat_stealc
Size 20.6MB
Sample260720-rcyt4aev2v
SHA256 2ee77f134c34f0eb4104884a6c5cd0138c9982d9a6497cd2264648ebb521fbb9
MD5 ebf61149223e62c18825890bdf60a7ce
SHA1 0d0072bfb6114dbe962ebd24ade0c52e534fd8a3
SHA512 5840534814bb6ed3c4db21aee699d367d8331e8c8deff330703e73ab9f9b3ba9221c9a571a604b2a8483d1e66c828496956afe5601e9b6034636c6b26adf2bde
SSDEEP 393216:vRKzCgdt1t5578vjtpyWWYAfUg5V+k0vD3gvxgh0:MzCgdV5Wvf9GUg5V30vD3gvxgh0
TLSH
T1EA275DF67046C07EC70C807AC690CF1EB93868955AE25BC3859439F13AABCB87AD7D45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_ebf61149223e62c18825890bdf60a7ce_glassworm_icedid_njrat_stealc

File Explorer

2026-07-20_ebf61149223e62c18825890bdf60a7ce_glassworm_icedid_njrat_stealc

.exe 20.6MB

2026-07-20_ebf61149223e62c18825890bdf60a7ce_glassworm_icedid_njrat_stealc

IMPHASH ed777c147d9ea9f482251eaea227d3e1
SHA256 2ee77f134c34f0eb4104884a6c5cd0138c9982d9a6497cd2264648ebb521fbb9
MD5 ebf61149223e62c18825890bdf60a7ce
SHA1 0d0072bfb6114dbe962ebd24ade0c52e534fd8a3
SHA512 5840534814bb6ed3c4db21aee699d367d8331e8c8deff330703e73ab9f9b3ba9221c9a571a604b2a8483d1e66c828496956afe5601e9b6034636c6b26adf2bde
SSDEEP 393216:vRKzCgdt1t5578vjtpyWWYAfUg5V+k0vD3gvxgh0:MzCgdV5Wvf9GUg5V30vD3gvxgh0
TLSH
T1EA275DF67046C07EC70C807AC690CF1EB93868955AE25BC3859439F13AABCB87AD7D45
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21553152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dcomp

DCompositionCreateDevice

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory D3DX11GetImageInfoFromFileA D3DX11CreateShaderResourceViewFromFileA

crypt32

CryptUnprotectData CryptProtectData

winmm

mciSendStringA timeBeginPeriod PlaySoundW

ntdll

RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind VerSetConditionMask RtlUnwind

kernel32

K32GetModuleBaseNameW Process32FirstW K32GetModuleInformation VirtualAllocEx VirtualFreeEx GetExitCodeProcess CreateDirectoryW FindFirstFileW GetFileSizeEx FindNextFileW WriteFile SetEndOfFile FindClose CreateFileW SetFilePointerEx ExitProcess GetCurrentProcessId FlushFileBuffers GetCommandLineW ProcessIdToSessionId WriteProcessMemory GetExitCodeThread LoadLibraryW VirtualProtectEx ReadProcessMemory SizeofResource LockResource LoadResource FindResourceW GetVolumeInformationA LocalFree GetFileAttributesExW ReadFile VirtualProtect GetThreadContext TerminateProcess IsDebuggerPresent CheckRemoteDebuggerPresent HeapWalk DuplicateHandle GetSystemInfo GetProcessHeap VirtualLock VirtualQuery GetSystemDirectoryW GetSystemWow64DirectoryW K32EnumProcessModules GlobalMemoryStatusEx SetLastError CreateMutexA CreateThread OpenProcess FlsSetValue FlsGetValue FlsAlloc InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW GetStringTypeW GetCPInfo CompareStringEx WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle FindFirstFileExW GetLocaleInfoEx SleepConditionVariableSRW GetCurrentThreadId GetModuleHandleExW AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageA InitOnceBeginInitialize InitOnceComplete LoadLibraryExA RaiseException HeapQueryInformation IsValidCodePage GetACP GetOEMCP GetTimeZoneInformation GetStdHandle GetFileType WriteConsoleW IsProcessorFeaturePresent UnhandledExceptionFilter IsValidLocale HeapFree HeapAlloc CreateProcessW LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW K32EnumProcessModulesEx MapViewOfFile CreateEventA GetModuleHandleW CreateFileMappingA GetCurrentThread SetEvent UnmapViewOfFile SetThreadPriority GetCurrentProcess SetPriorityClass GetLocalTime QueryPerformanceCounter FreeLibrary IsDBCSLeadByte QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar OutputDebugStringA CreateRemoteThread WaitForSingleObject GetModuleFileNameW GetTickCount GetProcAddress GetModuleHandleA SetUnhandledExceptionFilter Module32NextW Module32FirstW CloseHandle GetLastError GetTickCount64 Sleep CreateToolhelp32Snapshot ExitThread GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetConsoleMode ReadConsoleW GetConsoleOutputCP OutputDebugStringW Process32NextW FreeLibraryAndExitThread FlsFree HeapSize SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA

user32

SendMessageW SetWindowRgn SetLayeredWindowAttributes PostQuitMessage ShowCursor MapVirtualKeyW GetKeyboardState ToUnicode SetWindowDisplayAffinity GetWindowThreadProcessId GetWindowTextLengthW IsWindowVisible EnumWindows GetClassNameW GetWindowTextW GetWindowLongW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetMonitorInfoW IsChild MoveWindow BringWindowToTop UpdateWindow GetWindowRect SetWindowPos GetWindowTextA GetWindowLongPtrW MapWindowPoints GetRawInputData ClipCursor SetForegroundWindow GetKeyNameTextA MapVirtualKeyA DefWindowProcW GetKeyState GetMessageExtraInfo MonitorFromWindow ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData EnumDisplayDevicesA MessageBoxW DispatchMessageW PeekMessageW TranslateMessage SetCursor GetClientRect GetAsyncKeyState GetClassNameA MessageBoxA RegisterRawInputDevices SetWindowLongPtrW IsWindow PostMessageW

gdi32

CreateRoundRectRgn

advapi32

GetTokenInformation RegQueryValueExA RegCloseKey RegDeleteValueA RegOpenKeyExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW LookupPrivilegeNameW ConvertSidToStringSidA RevertToSelf SetTokenInformation ImpersonateLoggedOnUser CreateProcessAsUserW DuplicateTokenEx RegOpenKeyExW

shell32

SHGetFolderPathW ShellExecuteW SHCreateDirectoryExW

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.1337

Size

512B

Virtual Size

61B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

267KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.s722

Size

9.0MB

Virtual Size

9.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_ebf61149223e62c18825890bdf60a7ce_glassworm_icedid_njrat_stealc

dcomp

d3dcompiler_43

d3dx11_43

crypt32

winmm

ntdll

kernel32

user32

gdi32

advapi32

shell32

imm32

generic