2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat
Size 1.7MB
Sample260729-a41dkadn2x
SHA256 c5aa67c0bfa2980e2a3754e5a51394248e9ead4adb56b3303cfb5b906df055b5
MD5 8febe9ee71692179953f178e83f9c8e6
SHA1 8b03d9acc8943f28dfa5a2edd788b73baed94f14
SHA512 098a3ca79604a0b4eac2e66a5b71e82c44d980478f81ebc62dc25a906c3333df4cddf43e4e7aed4ad421d6739f12f0ddf33c66d4f3fe2ebee61bc466c6b970a9
SSDEEP 49152:xTyCXwCyP1yxhx1oogFsIBU2NdL4glRPG:NyCXDnxhzDgFU2Dh
TLSH
T1D485F169A7A400F8D1F7D275CD424807EB72B84A4771A99F33ED45960F336A09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat

File Explorer

2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat

.exe .js 1.7MB

2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat

IMPHASH dbfa7d70bc92399a77a52e6a592b7ee8
SHA256 c5aa67c0bfa2980e2a3754e5a51394248e9ead4adb56b3303cfb5b906df055b5
MD5 8febe9ee71692179953f178e83f9c8e6
SHA1 8b03d9acc8943f28dfa5a2edd788b73baed94f14
SHA512 098a3ca79604a0b4eac2e66a5b71e82c44d980478f81ebc62dc25a906c3333df4cddf43e4e7aed4ad421d6739f12f0ddf33c66d4f3fe2ebee61bc466c6b970a9
SSDEEP 49152:xTyCXwCyP1yxhx1oogFsIBU2NdL4glRPG:NyCXDnxhzDgFU2Dh
TLSH
T1D485F169A7A400F8D1F7D275CD424807EB72B84A4771A99F33ED45960F336A09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables Discord URL observed in first stage droppers
Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1488304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey GetUserNameA

user32

ShowWindow MessageBoxW

winhttp

WinHttpSendRequest WinHttpSetOption WinHttpConnect WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpWriteData WinHttpQueryHeaders WinHttpCloseHandle WinHttpAddRequestHeaders WinHttpSetTimeouts

iphlpapi

GetAdaptersInfo

kernel32

HeapSize WriteConsoleW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW SetEndOfFile GetACP IsValidCodePage HeapReAlloc ReadConsoleW CreatePipe GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetOEMCP EncodePointer GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle GetModuleHandleA MultiByteToWideChar GetTempPathA GetFileAttributesA CloseHandle GetConsoleWindow SetConsoleOutputCP GetComputerNameA ExpandEnvironmentStringsW WaitForSingleObject ReadFile SetFilePointer CreateFileW GetLastError CreateProcessW WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId Sleep GetCurrentProcessId WideCharToMultiByte GetTickCount ConnectNamedPipe GetModuleHandleW GetLogicalDrives FindFirstFileA FindNextFileA GetEnvironmentVariableA FindClose CreateFileA GetFileSize LocalFree FormatMessageA GetLocaleInfoEx FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetTempPathW AreFileApisANSI GetProcAddress GetFileInformationByHandleEx QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwind DecodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead GetCurrentProcess TerminateProcess GetTimeFormatW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW DuplicateHandle ExitProcess GetModuleFileNameW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat

version

advapi32

user32

winhttp

iphlpapi

kernel32

generic