2026-07-28_bae6b96e275cb5b732ddf3a7d4054775_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_bae6b96e275cb5b732ddf3a7d4054775_glassworm_icedid_luca-stealer_njrat_stealc
Size 2.0MB
Sample260728-tas7yacj21
SHA256 5161e0ca16a74173852d0071a82f0413e1251ce392259733f359c8fdded16342
MD5 bae6b96e275cb5b732ddf3a7d4054775
SHA1 5a6b297c41fe4aec6c1b6c63f84b78b7a76c7af0
SHA512 f847fedc3a1589ec69cdd7bbfeb8d4720acee2f007e8e18988e65c78ac40b9c104e45b4bd17dfe63d6f78978c386de3fca838468915f4781156848a1e2d58f73
SSDEEP 24576:i40P1F9qkR91TW0W+D+/yd5vNtCZiRFx0r6NS+LnMtneoJXXQ1mL1:i421DN1605D+/yfRFGoLnM5eIQ1mL
TLSH
T12495D022F39851DDC966A4349DA29F0BE731784417109BDB23FD1E956FA76E00EBE380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_bae6b96e275cb5b732ddf3a7d4054775_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-28_bae6b96e275cb5b732ddf3a7d4054775_glassworm_icedid_luca-stealer_njrat_stealc

.exe 2.0MB

2026-07-28_bae6b96e275cb5b732ddf3a7d4054775_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 74586b4387f5a6d5b02b1b2cbababe24
SHA256 5161e0ca16a74173852d0071a82f0413e1251ce392259733f359c8fdded16342
MD5 bae6b96e275cb5b732ddf3a7d4054775
SHA1 5a6b297c41fe4aec6c1b6c63f84b78b7a76c7af0
SHA512 f847fedc3a1589ec69cdd7bbfeb8d4720acee2f007e8e18988e65c78ac40b9c104e45b4bd17dfe63d6f78978c386de3fca838468915f4781156848a1e2d58f73
SSDEEP 24576:i40P1F9qkR91TW0W+D+/yd5vNtCZiRFx0r6NS+LnMtneoJXXQ1mL1:i421DN1605D+/yfRFGoLnM5eIQ1mL
TLSH
T12495D022F39851DDC966A4349DA29F0BE731784417109BDB23FD1E956FA76E00EBE380
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

604508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\zia\Desktop\FiveM updated 30dort\Build\30dort\Loader.pdb

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader RtlVirtualUnwind RtlUnwind

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

GetProcAddress FreeLibrary QueryPerformanceCounter ReadFile Process32First SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle Module32Next GetEnvironmentVariableA Module32First OpenProcess CreateToolhelp32Snapshot Sleep QueryFullProcessImageNameA CreateFileA GetCurrentThread Process32Next CloseHandle K32GetModuleBaseNameA FreeConsole K32GetModuleInformation GetThreadContext VirtualAllocEx ExitProcess GetCurrentProcessId K32EnumProcessModules AllocConsole IsDebuggerPresent CheckRemoteDebuggerPresent GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage MultiByteToWideChar FindFirstFileExW FindClose QueryPerformanceFrequency CreateProcessW GetExitCodeProcess WaitForSingleObject GetTimeZoneInformation GetFileSizeEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock SetStdHandle HeapReAlloc CreateFileW SetEndOfFile GetModuleHandleExW LoadLibraryExW WideCharToMultiByte GlobalLock GlobalFree GetFileAttributesExW GlobalAlloc FindNextFileW WriteConsoleW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError GetLastError HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW GetModuleHandleW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead TryAcquireSRWLockExclusive InitializeCriticalSectionEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RaiseException

user32

EmptyClipboard SetClipboardData OpenClipboard GetCursorPos CloseClipboard GetClipboardData UpdateWindow ReleaseCapture DispatchMessageA DestroyWindow SetWindowPos keybd_event GetSystemMetrics ShowWindow GetAsyncKeyState SetWindowLongA SetWindowDisplayAffinity MapVirtualKeyA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage mouse_event PeekMessageA UnregisterClassA FindWindowA RegisterClassExA IsWindowUnicode GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect SetCursorPos

advapi32

RegOpenKeyExA RegCloseKey RegSetValueExA RegEnumValueA

shell32

ShellExecuteW

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

Name

.text

Size

818KB

Virtual Size

818KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

407KB

Virtual Size

406KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

745KB

Virtual Size

757KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_bae6b96e275cb5b732ddf3a7d4054775_glassworm_icedid_luca-stealer_njrat_stealc

ntdll

d3d11

d3dx11_43

kernel32

user32

advapi32

shell32

imm32

d3dcompiler_43

dwmapi

generic