2026-08-03_2712955c17a4926732f6d88a001cd8ea_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_2712955c17a4926732f6d88a001cd8ea_glassworm_icedid_luca-stealer_njrat_stealc
Size 11.8MB
Sample260803-pdb1lsxbqa
SHA256 89e10d7db5b130806365cbe89fcc6177ab97edcf9420e00fc89b3491ba62b1f1
MD5 2712955c17a4926732f6d88a001cd8ea
SHA1 49e46f40e07b1ca9353cfea51a2e62bd503b2de7
SHA512 13d587c60b1770b9751f6b991e07fdae913b5c91553cbeb61be8c53124326df409edf1f36192bb959295021f0c56b39797d2e8ba475e6cb754a4669c452abec4
SSDEEP 98304:cTviUGJAuAKWqUwppALdmIXYUiEConbw7KGCG/:cTYCwjAL/XtiECEs7KG
TLSH
T145C60868E5004C98E1B8E076985FBF42A46035AB4DFC79277B2D4E0D1FAD12F297A707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_2712955c17a4926732f6d88a001cd8ea_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-03_2712955c17a4926732f6d88a001cd8ea_glassworm_icedid_luca-stealer_njrat_stealc

.exe 11.8MB

2026-08-03_2712955c17a4926732f6d88a001cd8ea_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH df77b3ebb28b078e364c565e4977ff9a
SHA256 89e10d7db5b130806365cbe89fcc6177ab97edcf9420e00fc89b3491ba62b1f1
MD5 2712955c17a4926732f6d88a001cd8ea
SHA1 49e46f40e07b1ca9353cfea51a2e62bd503b2de7
SHA512 13d587c60b1770b9751f6b991e07fdae913b5c91553cbeb61be8c53124326df409edf1f36192bb959295021f0c56b39797d2e8ba475e6cb754a4669c452abec4
SSDEEP 98304:cTviUGJAuAKWqUwppALdmIXYUiEConbw7KGCG/:cTYCwjAL/XtiECEs7KG
TLSH
T145C60868E5004C98E1B8E076985FBF42A46035AB4DFC79277B2D4E0D1FAD12F297A707
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

809084

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

user32

UnregisterClassW CreateWindowExW IsWindow DestroyWindow ShowWindow SetLayeredWindowAttributes SetWindowPos SetWindowDisplayAffinity IsWindowVisible GetAsyncKeyState PostQuitMessage SetActiveWindow GetForegroundWindow SetForegroundWindow GetWindowTextW GetClientRect MessageBoxA MessageBoxW TranslateMessage DispatchMessageW PeekMessageW RegisterClassW DefWindowProcW UpdateWindow ClientToScreen TrackMouseEvent LoadCursorA ScreenToClient GetCursorPos SetCursor SetCursorPos IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo GetWindowLongW EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadIconW LoadCursorW GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW PostMessageW

gdi32

CreateSolidBrush

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA GetUserNameA

shell32

SHGetFolderPathW SHGetFolderPathA

iphlpapi

GetAdaptersInfo

wininet

InternetOpenA InternetCloseHandle InternetConnectA InternetOpenUrlA InternetReadFile InternetQueryOptionA InternetSetOptionA HttpOpenRequestA HttpSendRequestA

ws2_32

closesocket connect htons recv send setsockopt socket WSAStartup WSACleanup WSAGetLastError inet_pton

comdlg32

GetSaveFileNameA GetOpenFileNameA

d3dcompiler_47

D3DCompile

kernel32

VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetTimeZoneInformation HeapReAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteConsoleW GetFileType FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader GetDateFormatW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx SetFilePointerEx ReadConsoleW OutputDebugStringW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW GetTimeFormatW CompareStringW LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable GetSystemTimeAsFileTime GetProcessHeap SetStdHandle HeapSize SetEndOfFile GetTickCount64 GetStdHandle CreateDirectoryA CreateDirectoryW CreateFileA CreateFileW DeleteFileW FindClose FindFirstFileA FindNextFileA GetFileSize ReadFile WriteFile GetTempPathW GetVolumeInformationA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle SetUnhandledExceptionFilter GetLastError WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId ExitProcess GetExitCodeProcess CreateRemoteThread GetCurrentThread GetExitCodeThread GetThreadContext OpenProcess GetLocalTime GetTickCount RtlUnwind VirtualAllocEx ReadProcessMemory WriteProcessMemory OpenFileMappingW MapViewOfFile VirtualFreeEx UnmapViewOfFile FreeLibrary GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryExW WinExec FreeConsole GetConsoleMode SetConsoleMode SetConsoleTextAttribute SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GetCurrentThreadId GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency LoadLibraryA OutputDebugStringA WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.9MB

Virtual Size

7.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_2712955c17a4926732f6d88a001cd8ea_glassworm_icedid_luca-stealer_njrat_stealc

d3d11

dwmapi

user32

gdi32

advapi32

shell32

iphlpapi

wininet

ws2_32

comdlg32

d3dcompiler_47

kernel32

imm32

generic