General
- Target 2026-07-23_391bd79a9600b18356a139423219f376_glassworm_icedid_luca-stealer_njrat
- Size 10.4MB
- Sample260724-ak87csxyft
- SHA256 9c5ac64675c67f7e3a14ae8ab803e209693aca522ef94b288ee491d82b32331f
- MD5 391bd79a9600b18356a139423219f376
- SHA1 246d28c8e80e5c3b4b6e45347c1759a2925eac2d
- SHA512 6987d6688084d646559045b1bf5c4bd8b876fc7bed4d68e14ef16a309602616f70945d48d708cb3d1c95d3535ba3a4577f734e625bcbfb90d4e51549b04b46b5
- SSDEEP 49152:zSPzIv6bUoQDkFDzSOMkRffbf7zRSIRYgD/17+:zSLIdSDuOMkRD7oBgD
- TLSH T14EB6E19AD7E806B5D0E38171CD674A63DBB1744006608B4F93D81AC52F67F71ABBE322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-23_391bd79a9600b18356a139423219f376_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_391bd79a9600b18356a139423219f376_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_391bd79a9600b18356a139423219f376_glassworm_icedid_luca-stealer_njrat
- Size 10.4MB
- SHA256 9c5ac64675c67f7e3a14ae8ab803e209693aca522ef94b288ee491d82b32331f
- MD5 391bd79a9600b18356a139423219f376
- SHA1 246d28c8e80e5c3b4b6e45347c1759a2925eac2d
- SHA512 6987d6688084d646559045b1bf5c4bd8b876fc7bed4d68e14ef16a309602616f70945d48d708cb3d1c95d3535ba3a4577f734e625bcbfb90d4e51549b04b46b5
- SSDEEP 49152:zSPzIv6bUoQDkFDzSOMkRffbf7zRSIRYgD/17+:zSLIdSDuOMkRD7oBgD
- TLSH T14EB6E19AD7E806B5D0E38171CD674A63DBB1744006608B4F93D81AC52F67F71ABBE322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.