2026-07-31_848f52b346a933f73ece47882dbcb28c_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_848f52b346a933f73ece47882dbcb28c_glassworm_icedid_luca-stealer_njrat_stealc
Size 5.1MB
Sample260731-dclb4saj21
SHA256 58be23b751b3986c4f80e244ff87e23e2fb934ff6f76406207784933499d6bda
MD5 848f52b346a933f73ece47882dbcb28c
SHA1 373db186a0d32277c3c027884f7b6f6910f3bb2f
SHA512 f96596d90d159ba9f7ec4679afe68308be8270272deb4ade3168836d04e16802097c1bc54b9d60c979a8f6543d13fd3c3f434fd69a86d4ad835d06089a28d967
SSDEEP 24576:lTGgDD1gs4ywzQMFg4YrPRFckJYD3jbDDBModwhNVJe4Kjrln5UniGDzURWhBLS2:dXHzzFJEMo/WhW8EfOoH+RL1Gh
TLSH
T126468D1A7E6808B9C1EEC27489255923DAB278421731DFDFA290DD955F33EE2077E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_848f52b346a933f73ece47882dbcb28c_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-31_848f52b346a933f73ece47882dbcb28c_glassworm_icedid_luca-stealer_njrat_stealc

.exe 5.1MB

2026-07-31_848f52b346a933f73ece47882dbcb28c_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH b866d0a6ba6f2d9c966e9d56e6b99613
SHA256 58be23b751b3986c4f80e244ff87e23e2fb934ff6f76406207784933499d6bda
MD5 848f52b346a933f73ece47882dbcb28c
SHA1 373db186a0d32277c3c027884f7b6f6910f3bb2f
SHA512 f96596d90d159ba9f7ec4679afe68308be8270272deb4ade3168836d04e16802097c1bc54b9d60c979a8f6543d13fd3c3f434fd69a86d4ad835d06089a28d967
SSDEEP 24576:lTGgDD1gs4ywzQMFg4YrPRFckJYD3jbDDBModwhNVJe4Kjrln5UniGDzURWhBLS2:dXHzzFJEMo/WhW8EfOoH+RL1Gh
TLSH
T126468D1A7E6808B9C1EEC27489255923DAB278421731DFDFA290DD955F33EE2077E720
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1580292

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpAddRequestHeaders

crypt32

CryptUnprotectData CryptStringToBinaryA CryptBinaryToStringA

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptDestroyKey BCryptDestroyHash BCryptGenerateSymmetricKey BCryptDecrypt BCryptCreateHash BCryptHashData BCryptFinishHash BCryptEncrypt

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlInitUnicodeString RtlPcToFileHeader RtlUnwind

kernel32

SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleOutputCP Sleep GetLastError ExitProcess OpenProcess CloseHandle QueryFullProcessImageNameW GetTickCount ReadFile WriteProcessMemory WriteFile TerminateProcess CreateNamedPipeW DisconnectNamedPipe GetTempPathA VirtualProtectEx VirtualAllocEx GetCurrentProcessId CreateProcessW CreateRemoteThread ConnectNamedPipe LocalFree FindFirstFileW FindNextFileW FindClose GetFileAttributesExW GetTempPathW GetSystemTime GetModuleFileNameW CreateMutexA ExitThread GetTickCount64 GetDiskFreeSpaceExW GetComputerNameW CopyFileW CreateDirectoryA SetUnhandledExceptionFilter GetFileSizeEx OutputDebugStringA GetEnvironmentVariableA CreateFileW GetFileAttributesW UnmapViewOfFile MultiByteToWideChar WriteConsoleW WideCharToMultiByte CreateFileMappingW MapViewOfFile LoadLibraryW GetProcAddress FreeLibrary SetDllDirectoryW AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW WaitForSingleObject GetCurrentThreadId GetVersionExW HeapValidate HeapSize FormatMessageW GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx GetVersionExA DeleteFileA DeleteFileW HeapReAlloc RaiseException GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetFileSize DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime FormatMessageA GetModuleHandleExW FlushFileBuffers FreeLibraryAndExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW QueryPerformanceCounter SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive CreateDirectoryW FindFirstFileExW GetFinalPathNameByHandleW SetFileInformationByHandle GetModuleHandleW GetFileInformationByHandleEx GetLocaleInfoEx WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead SetLastError InitializeCriticalSectionAndSpinCount LCMapStringW

user32

GetWindowRect GetAsyncKeyState GetForegroundWindow GetWindowTextW GetWindowTextLengthW GetWindowThreadProcessId

advapi32

RegSetValueExA RegOpenKeyExA GetUserNameW RegCloseKey RegOpenKeyExW RegQueryValueExW CryptAcquireContextW CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_848f52b346a933f73ece47882dbcb28c_glassworm_icedid_luca-stealer_njrat_stealc

winhttp

crypt32

bcrypt

ntdll

kernel32

user32

advapi32

generic