2026-07-31_97fbcf67f0bfd2f5831a4c64e6d77355_glassworm_icedid_luca-stealer_njrat_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_97fbcf67f0bfd2f5831a4c64e6d77355_glassworm_icedid_luca-stealer_njrat_quasar-rat
Size 14.7MB
Sample260731-3htccas1dv
SHA256 d65ef7aee579941945ef139479e3b4a57954adb7eb73a83f98e833836ccaac12
MD5 97fbcf67f0bfd2f5831a4c64e6d77355
SHA1 529404d4eb2b61a2fd1af8b7cb0351775a2096c3
SHA512 9eb30688c07310615f73a4b355660abd70985c4fcdc24db79a17523774572021adebb4de631fe5c822fcca19bbe2189e29a5f86f467e3489f60daf52c54f47c8
SSDEEP 393216:zQLKRFfkPRkvrGtZq5XO6ZLHsGXq57SCtM:zQodAkrGtZq5DztXyO
TLSH
T1F7F6F18369CB0DE5DDD277B861C7233AA774FD758A295F2B6A04C2312D536C4AD2EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_97fbcf67f0bfd2f5831a4c64e6d77355_glassworm_icedid_luca-stealer_njrat_quasar-rat

File Explorer

2026-07-31_97fbcf67f0bfd2f5831a4c64e6d77355_glassworm_icedid_luca-stealer_njrat_quasar-rat

.exe 14.7MB
FFlagbrowserv3.pyc

69KB

2026-07-31_97fbcf67f0bfd2f5831a4c64e6d77355_glassworm_icedid_luca-stealer_njrat_quasar-rat

IMPHASH 0bb21657c8f8d76e296c5c8e65b738fc
SHA256 d65ef7aee579941945ef139479e3b4a57954adb7eb73a83f98e833836ccaac12
MD5 97fbcf67f0bfd2f5831a4c64e6d77355
SHA1 529404d4eb2b61a2fd1af8b7cb0351775a2096c3
SHA512 9eb30688c07310615f73a4b355660abd70985c4fcdc24db79a17523774572021adebb4de631fe5c822fcca19bbe2189e29a5f86f467e3489f60daf52c54f47c8
SSDEEP 393216:zQLKRFfkPRkvrGtZq5XO6ZLHsGXq57SCtM:zQodAkrGtZq5DztXyO
TLSH
T1F7F6F18369CB0DE5DDD277B861C7233AA774FD758A295F2B6A04C2312D536C4AD2EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

GetTokenInformation OpenProcessToken

comdlg32

GetOpenFileNameA

kernel32

CloseHandle CreateDirectoryA CreateEventA CreateFileA CreateMutexA CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DuplicateHandle EnterCriticalSection FormatMessageA GetCPInfo GetConsoleMode GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFileInformationByHandle GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStdHandle GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LocalFree Module32First Module32Next MoveFileExA MultiByteToWideChar OpenProcess OutputDebugStringA Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadProcessMemory ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCursorInfo SetConsoleMode SetConsoleOutputCP SetConsoleTextAttribute SetConsoleTitleA SetEvent SetFileAttributesA SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile WriteProcessMemory

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _exit _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _get_osfhandle _getch _initterm _kbhit _lseeki64 _read _setjmp _setmode _strdup _stricmp _strtoi64 _strtoui64 _vscprintf _vsnprintf _wfopen _write abort atexit calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc isspace iswctype isxdigit localeconv longjmp malloc memchr memcmp memcpy memmove memset putc putwc realloc setlocale setvbuf strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm system tolower toupper towupper ungetwc towlower ungetc vfprintf wcscoll wcsftime wcslen wcsxfrm

shell32

ShellExecuteA

user32

IsWindowVisible MoveWindow ShowWindow

wininet

HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetQueryDataAvailable InternetReadFile

Name

.text

Size

956KB

Virtual Size

956KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

11.6MB

Virtual Size

11.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_97fbcf67f0bfd2f5831a4c64e6d77355_glassworm_icedid_luca-stealer_njrat_quasar-rat

advapi32

comdlg32

kernel32

msvcrt

shell32

user32

wininet

generic

FFlagbrowserv3.pyc