2026-08-01_7d0a1451657966ad63988895ae34578c_glassworm_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_7d0a1451657966ad63988895ae34578c_glassworm_icedid_njrat_stealc
Size 21.2MB
Sample260802-ap75vsah77
SHA256 c90a46ab5b41dc22ed5628db34cb3bf214eb6031d6f8ea06e382e8fcab48eb01
MD5 7d0a1451657966ad63988895ae34578c
SHA1 2d627e5668a9816f8697f5c74a6afb39ca74489f
SHA512 29146c73ff30d53ac7b670e69c98640dd5e000e631960bbe3553dff61206ea3c54ea64431cdad21abe8248d0c3e8370fd8a5dc9fb6452cda4bbcea17e1888446
SSDEEP 393216:4zv/UlZOpM2PQyZtXlIROg5V+METGqYpz:MNpMRUlIog5VOT3Ypz
TLSH
T1B4274BB77101D0BDC64940BAC691CF2ABD3868A59EF24BC384C039E12E6AD7C7AD7D45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_7d0a1451657966ad63988895ae34578c_glassworm_icedid_njrat_stealc

File Explorer

2026-08-01_7d0a1451657966ad63988895ae34578c_glassworm_icedid_njrat_stealc

.exe 21.2MB

2026-08-01_7d0a1451657966ad63988895ae34578c_glassworm_icedid_njrat_stealc

IMPHASH 76065f08cd0534a1955786c4edfb0901
SHA256 c90a46ab5b41dc22ed5628db34cb3bf214eb6031d6f8ea06e382e8fcab48eb01
MD5 7d0a1451657966ad63988895ae34578c
SHA1 2d627e5668a9816f8697f5c74a6afb39ca74489f
SHA512 29146c73ff30d53ac7b670e69c98640dd5e000e631960bbe3553dff61206ea3c54ea64431cdad21abe8248d0c3e8370fd8a5dc9fb6452cda4bbcea17e1888446
SSDEEP 393216:4zv/UlZOpM2PQyZtXlIROg5V+METGqYpz:MNpMRUlIog5VOT3Ypz
TLSH
T1B4274BB77101D0BDC64940BAC691CF2ABD3868A59EF24BC384C039E12E6AD7C7AD7D45
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22093824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dcomp

DCompositionCreateDevice

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory D3DX11GetImageInfoFromFileA D3DX11CreateShaderResourceViewFromFileA

crypt32

CryptUnprotectData CryptProtectData

winmm

mciSendStringA timeBeginPeriod PlaySoundW

ntdll

RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind VerSetConditionMask RtlUnwind

kernel32

OpenProcess Process32NextW K32GetModuleBaseNameW Process32FirstW K32GetModuleInformation VirtualAllocEx VirtualFreeEx GetExitCodeProcess CreateDirectoryW FindFirstFileW GetFileSizeEx FindNextFileW WriteFile SetEndOfFile FindClose CreateFileW SetFilePointerEx ExitProcess GetCurrentProcessId FlushFileBuffers ProcessIdToSessionId WriteProcessMemory GetExitCodeThread LoadLibraryW VirtualProtectEx ReadProcessMemory SizeofResource LockResource LoadResource FindResourceW GetVolumeInformationA LocalFree GetFileAttributesExW ReadFile VirtualProtect GetThreadContext TerminateProcess IsDebuggerPresent CheckRemoteDebuggerPresent HeapWalk DuplicateHandle GetSystemInfo GetProcessHeap VirtualLock VirtualQuery GetSystemDirectoryW GetSystemWow64DirectoryW K32EnumProcessModules GlobalMemoryStatusEx SetLastError CreateMutexA CreateThread MapViewOfFile FlsSetValue FlsGetValue FlsAlloc InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW GetStringTypeW GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection LCMapStringEx WakeAllConditionVariable GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle FindFirstFileExW GetLocaleInfoEx FormatMessageA SleepConditionVariableSRW GetModuleHandleExW GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive InitOnceBeginInitialize InitOnceComplete LoadLibraryExA RaiseException GetACP GetOEMCP GetTimeZoneInformation GetCommandLineA GetEnvironmentStringsW IsProcessorFeaturePresent GetStdHandle UnhandledExceptionFilter HeapFree HeapAlloc GetUserDefaultLCID GetFileType CreateProcessW LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW IsValidLocale CreateEventA GetModuleHandleW CreateFileMappingA GetCurrentThread SetEvent UnmapViewOfFile SetThreadPriority GetCurrentProcess SetPriorityClass GetLocalTime FreeConsole GetCommandLineW QueryPerformanceCounter FreeLibrary IsDBCSLeadByte QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar OutputDebugStringA CreateRemoteThread WaitForSingleObject GetModuleFileNameW GetTickCount GetProcAddress GetModuleHandleA SetUnhandledExceptionFilter Module32NextW Module32FirstW CloseHandle GetLastError GetTickCount64 Sleep CreateToolhelp32Snapshot ExitThread EnumSystemLocalesW HeapReAlloc GetConsoleMode ReadConsoleW GetConsoleOutputCP HeapSize HeapQueryInformation GetLocaleInfoW K32EnumProcessModulesEx FreeLibraryAndExitThread FlsFree WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW IsValidCodePage

user32

SendMessageW SetWindowRgn PostQuitMessage ShowCursor MapVirtualKeyW GetKeyboardState ToUnicode SetWindowDisplayAffinity GetWindowThreadProcessId GetWindowTextLengthW IsWindowVisible EnumWindows GetClassNameW GetWindowTextW GetWindowLongW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetMonitorInfoW IsChild MoveWindow BringWindowToTop UpdateWindow GetWindowRect SetWindowPos GetWindowTextA GetWindowLongPtrW MapWindowPoints GetRawInputData ClipCursor SetForegroundWindow GetKeyNameTextA MapVirtualKeyA DefWindowProcW GetKeyState GetMessageExtraInfo MonitorFromWindow ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData EnumDisplayDevicesA MessageBoxW DispatchMessageW PeekMessageW TranslateMessage SetCursor GetClientRect GetAsyncKeyState GetClassNameA MessageBoxA RegisterRawInputDevices SetWindowLongPtrW IsWindow PostMessageW

gdi32

CreateRoundRectRgn

advapi32

GetTokenInformation RegQueryValueExA RegCloseKey RegDeleteValueA RegOpenKeyExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW LookupPrivilegeNameW ConvertSidToStringSidA RevertToSelf SetTokenInformation ImpersonateLoggedOnUser CreateProcessAsUserW DuplicateTokenEx RegOpenKeyExW

shell32

SHGetFolderPathW ShellExecuteW SHCreateDirectoryExW

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.1337

Size

512B

Virtual Size

61B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

267KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rwju

Size

9.6MB

Virtual Size

9.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rcd082

Size

140KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_7d0a1451657966ad63988895ae34578c_glassworm_icedid_njrat_stealc

dcomp

d3dcompiler_43

d3dx11_43

crypt32

winmm

ntdll

kernel32

user32

gdi32

advapi32

shell32

imm32

generic