2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat
Size 2.7MB
Sample260727-eefp3svxet
SHA256 fe3518e01aa4fb0b5c05c6e7ea53e2e6b59caf3aea388458cdb29a5c8401a910
MD5 09dd1ff525fb8d23b7b99169b29a773b
SHA1 98ff9f7c96d23dd42d5173c23cdc2e8a9fb5c088
SHA512 b429072e57399693b8d20e4a7d0fb8122f83c7e2c29ed53326de8b185e9dbc6020b6364b574490a55400c7879e106efff6e7f7e80055fd74df06c7cc96c80e46
SSDEEP 49152:5IhqK0byTx/H8xjigE12dF8YPJ2q5FkWGcaUeI+xdWUxkT72mgv:vby9/chigj/1ZeZHW+pv
TLSH
T17BD5E00FA76801F9D0A7C2B5CF465A07D7B2B8464270A79F13E5CAD61F276614E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat

File Explorer

2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat

.exe 2.7MB

2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat

IMPHASH c8d0c4148bd31ff771de417712511949
SHA256 fe3518e01aa4fb0b5c05c6e7ea53e2e6b59caf3aea388458cdb29a5c8401a910
MD5 09dd1ff525fb8d23b7b99169b29a773b
SHA1 98ff9f7c96d23dd42d5173c23cdc2e8a9fb5c088
SHA512 b429072e57399693b8d20e4a7d0fb8122f83c7e2c29ed53326de8b185e9dbc6020b6364b574490a55400c7879e106efff6e7f7e80055fd74df06c7cc96c80e46
SSDEEP 49152:5IhqK0byTx/H8xjigE12dF8YPJ2q5FkWGcaUeI+xdWUxkT72mgv:vby9/chigj/1ZeZHW+pv
TLSH
T17BD5E00FA76801F9D0A7C2B5CF465A07D7B2B8464270A79F13E5CAD61F276614E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2426740

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

shell32

SHGetFolderPathW ShellExecuteExW

advapi32

CredEnumerateW AdjustTokenPrivileges GetCurrentHwProfileA LookupPrivilegeValueA CredFree RegCreateKeyExW RegSetValueExW RegOpenKeyExA GetUserNameA RegQueryValueExA RegCloseKey GetTokenInformation OpenProcessToken LookupAccountSidA

user32

ShowWindow GetDC ReleaseDC

gdi32

CreateCompatibleDC SelectObject DeleteObject CreateCompatibleBitmap BitBlt GetDeviceCaps DeleteDC

ole32

CreateStreamOnHGlobal GetHGlobalFromStream CLSIDFromString

kernel32

IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW HeapReAlloc IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW SizeofResource Process32First GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle WriteFile GetModuleFileNameW GetProcessId WaitForSingleObject CreateFileW OpenProcess CreateToolhelp32Snapshot Sleep GetLastError LockResource Process32Next CloseHandle LoadResource FindResourceW GetConsoleWindow SetConsoleOutputCP GetComputerNameA ExpandEnvironmentStringsW ReadFile SetFilePointer CreateProcessW CreateNamedPipeW PeekNamedPipe GetCurrentThreadId GetCurrentProcessId WideCharToMultiByte GetTickCount ConnectNamedPipe GetModuleHandleW CreateDirectoryW FindFirstFileW FindFirstFileA EnterCriticalSection FindNextFileW GetCurrentProcess TerminateProcess FindNextFileA LeaveCriticalSection InitializeCriticalSection GetEnvironmentVariableW FindClose GetFileAttributesW Process32NextW K32GetProcessMemoryInfo GlobalSize DeleteFileW Process32FirstW GetSystemInfo GetProcAddress GlobalLock LocalFree DeleteCriticalSection ExitProcess GlobalMemoryStatusEx CopyFileW QueryFullProcessImageNameW GlobalUnlock AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx DeleteFileA RtlUnwind RaiseException HeapAlloc HeapCompact HeapDestroy UnlockFile LockFileEx GetFileSize GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter FlushFileBuffers VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA GetLocaleInfoEx FindFirstFileExW GetFileInformationByHandleEx QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW GetTickCount64 GetExitCodeThread WakeConditionVariable WakeAllConditionVariable LCMapStringEx InitializeCriticalSectionEx EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat

version

shell32

advapi32

user32

gdi32

ole32

kernel32

generic