751stealer | 2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat
Size 1.7MB
Sample260723-ap6l2aed28
SHA256 4cd602fdb60037ff631fcccd4a2cc5806cfdaf360eab0960e15f40f72bf8b7fd
MD5 113423fbd3221a2d1e7e2f09b2634486
SHA1 bc604d0ed2db34cb8e128530e3e1157ea2c7a982
SHA512 6f0382bea06e85169acd545a4b3b4a2b0965d9b3f41888eae464637323cc4e3fdf97dc2f941d219c296ed149aa3646511d2efbd548141056a79f353f94721eca
SSDEEP 49152:xs4ioC7pzJdOiMqQuPi5lFH3VlKOqfL7dUFk:GLMqQbrFXVlKRlUF
TLSH
T1E885F15992A400F8D1B7D274CE56890BE772FC094BB0A64F33DD59960F736A09E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer 751stealer

Malware Config

Extracted

Family

751stealer

http://stealer.best

Attributes

owner_id
7511aabbccddeeff

Signatures

Family: 751Stealer
751 Stealer is a Windows infostealer distributed as a .NET 8 single-file bundle that grabs browser data, files, and crypto wallets.
stealer 751stealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat

File Explorer

2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat

.exe 1.7MB

2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat

IMPHASH 25214412b366dbf9e513a1cbd051174a
SHA256 4cd602fdb60037ff631fcccd4a2cc5806cfdaf360eab0960e15f40f72bf8b7fd
MD5 113423fbd3221a2d1e7e2f09b2634486
SHA1 bc604d0ed2db34cb8e128530e3e1157ea2c7a982
SHA512 6f0382bea06e85169acd545a4b3b4a2b0965d9b3f41888eae464637323cc4e3fdf97dc2f941d219c296ed149aa3646511d2efbd548141056a79f353f94721eca
SSDEEP 49152:xs4ioC7pzJdOiMqQuPi5lFH3VlKOqfL7dUFk:GLMqQbrFXVlKRlUF
TLSH
T1E885F15992A400F8D1B7D274CE56890BE772FC094BB0A64F33DD59960F736A09E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1457436

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

shell32

ShellExecuteExW SHGetFolderPathW

advapi32

RegQueryValueExA CredFree RegCreateKeyExW RegSetValueExW AdjustTokenPrivileges GetCurrentHwProfileA CredEnumerateW RegOpenKeyExA GetUserNameA LookupPrivilegeValueA RegCloseKey GetTokenInformation OpenProcessToken LookupAccountSidA

user32

OpenClipboard CloseDesktop IsWindow GetThreadDesktop SetThreadDesktop GetSystemMetrics keybd_event GetDC CloseClipboard DispatchMessageA GetWindowTextW SetForegroundWindow UpdateWindow GetClientRect TranslateMessage SetLayeredWindowAttributes RegisterClassW ExitWindowsEx LockWorkStation DestroyWindow ShowWindow MessageBoxW DispatchMessageW SetWindowTextW SendMessageW CreateWindowExW FillRect SetWindowRgn SetWindowPos LoadCursorA GetFocus GetKeyState DefWindowProcW GetMessageW GetWindowTextLengthW ReleaseDC OpenInputDesktop GetClipboardData SendMessageA mouse_event CreateDesktopA SwitchDesktop PeekMessageA GetDesktopWindow SystemParametersInfoW SetCursorPos SendInput MessageBoxA

gdiplus

GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdiplusStartup GdipSaveImageToStream GdipCreateBitmapFromScan0

gdi32

CreateFontW GetStockObject CreateRoundRectRgn SetTextColor SetBkColor CreateSolidBrush BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateDIBitmap GetDeviceCaps DeleteDC DeleteObject

ole32

CLSIDFromString GetHGlobalFromStream CreateStreamOnHGlobal

winhttp

WinHttpOpenRequest WinHttpReadData WinHttpSendRequest WinHttpReceiveResponse WinHttpSetOption WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpOpen WinHttpAddRequestHeaders

ws2_32

WSASend WSAStartup getaddrinfo socket connect recv freeaddrinfo setsockopt WSAGetLastError WSACleanup closesocket

wlanapi

WlanEnumInterfaces WlanCloseHandle WlanFreeMemory WlanOpenHandle WlanGetProfile WlanGetProfileList

winmm

waveInClose waveInStop waveOutUnprepareHeader waveInAddBuffer waveOutClose waveInGetDevCapsW waveOutReset waveInOpen waveOutOpen waveOutPrepareHeader waveInPrepareHeader waveInStart waveInReset waveInUnprepareHeader waveInGetNumDevs waveOutWrite

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

d3d11

D3D11CreateDevice

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread EnumSystemLocalesW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent WriteConsoleW RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetCPInfo CompareStringEx DecodePointer EncodePointer HeapReAlloc ReadConsoleW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize SetStdHandle LoadLibraryExW GetProcessHeap GetSystemTimeAsFileTime InitializeCriticalSectionEx LCMapStringEx WakeAllConditionVariable WakeConditionVariable GetExitCodeThread WaitForSingleObjectEx GetTickCount64 SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency QueryPerformanceCounter MultiByteToWideChar GetFileInformationByHandleEx AreFileApisANSI GetFileAttributesExW FindFirstFileExW GetLocaleInfoEx FormatMessageA LocalFree GlobalUnlock CreateProcessA SetEndOfFile RtlVirtualUnwind GetConsoleWindow QueryFullProcessImageNameW CopyFileW SizeofResource GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle GetModuleFileNameW GetProcessId WaitForSingleObject GetModuleHandleA OpenProcess Sleep GetFileAttributesA LockResource CloseHandle LoadResource FindResourceW RtlUnwind SetConsoleOutputCP GetComputerNameA ExpandEnvironmentStringsW ReadFile SetFilePointer CreateFileW GetLastError CreateProcessW WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId GetCurrentProcessId WideCharToMultiByte GetTickCount ConnectNamedPipe GetModuleHandleW CreateDirectoryW FindFirstFileW Process32First SetHandleInformation FindFirstFileA EnterCriticalSection FindNextFileW GetCurrentProcess TerminateProcess FindNextFileA LeaveCriticalSection CreatePipe InitializeCriticalSection GetEnvironmentVariableW GetTempPathW FindClose GetFileAttributesW CreateToolhelp32Snapshot Process32NextW K32GetProcessMemoryInfo GlobalSize DeleteFileW Process32Next Process32FirstW GetSystemInfo GetProcAddress GlobalLock DeleteCriticalSection ExitProcess GlobalMemoryStatusEx

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat

version

shell32

advapi32

user32

gdiplus

gdi32

ole32

winhttp

ws2_32

wlanapi

winmm

avicap32

d3d11

kernel32

generic