2026-08-04_89135cd540335cbcfbd9785bd58ce8ee_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_89135cd540335cbcfbd9785bd58ce8ee_glassworm_icedid_luca-stealer_njrat_stealc
Size 2.4MB
Sample260804-g61knshl2x
SHA256 4f724ff0334e0dcc93fd695b8c46550e8ff3e5d900720d01a695a1018725005e
MD5 89135cd540335cbcfbd9785bd58ce8ee
SHA1 d35ef1152d7b8a723d839c41549e53b5c95cc9ae
SHA512 0b9a297a6321fda326f438c5fb8d5460d6b2338aaa9fd36bb0f1009f66acd1f9ccb9d84f12dfa45683b6b578bcba1cff1d2a052e0d14e71017df1fc1dc46cd73
SSDEEP 49152:xHuFaMYQkFANwFFpbi2QKGlZdQwDBnuaQwWQb5+Pl6bJTIZ5jdgp:rfFeslgJTIZ5Bgp
TLSH
T160C5BF26626801FCD06BD1B8D94A990BEBB17C0503B19BCF07A176E62F736E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_89135cd540335cbcfbd9785bd58ce8ee_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-04_89135cd540335cbcfbd9785bd58ce8ee_glassworm_icedid_luca-stealer_njrat_stealc

.exe 2.4MB

2026-08-04_89135cd540335cbcfbd9785bd58ce8ee_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH d39656ec2f45861e75694fb423f78a57
SHA256 4f724ff0334e0dcc93fd695b8c46550e8ff3e5d900720d01a695a1018725005e
MD5 89135cd540335cbcfbd9785bd58ce8ee
SHA1 d35ef1152d7b8a723d839c41549e53b5c95cc9ae
SHA512 0b9a297a6321fda326f438c5fb8d5460d6b2338aaa9fd36bb0f1009f66acd1f9ccb9d84f12dfa45683b6b578bcba1cff1d2a052e0d14e71017df1fc1dc46cd73
SSDEEP 49152:xHuFaMYQkFANwFFpbi2QKGlZdQwDBnuaQwWQb5+Pl6bJTIZ5jdgp:rfFeslgJTIZ5Bgp
TLSH
T160C5BF26626801FCD06BD1B8D94A990BEBB17C0503B19BCF07A176E62F736E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1012492

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\JenkinsWorkspace\workspace\client_build_installer\client\build\working_directory\RelWithDebInfo\UbisoftGameLauncher64.pdb

discord-rpc.x64

Discord_Shutdown Discord_UpdatePresence Discord_Initialize

steam_api64

SteamAPI_RegisterCallback SteamAPI_UnregisterCallResult SteamAPI_UnregisterCallback SteamInternal_FindOrCreateUserInterface SteamInternal_CreateInterface SteamInternal_ContextInit SteamAPI_GetHSteamUser SteamAPI_RunCallbacks SteamAPI_Shutdown SteamInternal_SteamAPI_Init SteamAPI_RegisterCallResult

shell32

ShellExecuteExW CommandLineToArgvW

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyW RegCloseKey GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW

user32

DispatchMessageW TranslateMessage AllowSetForegroundWindow PostMessageW GetSystemMetrics RegisterRawInputDevices GetRawInputData GetAsyncKeyState DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW PeekMessageW WaitMessage PostQuitMessage GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer

kernel32

GetConsoleOutputCP ReadConsoleW GetConsoleMode FlsAlloc GetFileType GetStdHandle LoadLibraryExW FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FlushFileBuffers SetStdHandle IsValidCodePage GetACP GetOEMCP GetCommandLineA WriteConsoleW HeapSize SetEnvironmentVariableW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable InitializeSListHead GetCPInfo LCMapStringEx CloseHandle GetLastError CreateIoCompletionPort GetQueuedCompletionStatus OpenProcess IsProcessInJob CreateJobObjectW AssignProcessToJobObject SetInformationJobObject QueryInformationJobObject CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentStringsW FreeEnvironmentStringsW IsDebuggerPresent DebugBreak OutputDebugStringW SetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcess TerminateProcess GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW WideCharToMultiByte SearchPathW CreateFileW GetFullPathNameW GetModuleFileNameW LoadLibraryW WaitForSingleObject Sleep GetModuleHandleExA GetExitCodeProcess OpenThread ResumeThread CreateProcessA CreateProcessW GetProcessId GetVersionExW GetNativeSystemInfo VirtualProtect IsWow64Process GetExitCodeThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAllocEx VirtualProtectEx WriteProcessMemory VirtualFreeEx ReadFile WriteFile GetOverlappedResult ResetEvent CreateEventW GetFileInformationByHandleEx CreateThread FindClose FindNextFileW GetFileSizeEx SetEndOfFile SetFilePointerEx GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentProcessId ExitProcess LocalFree GetTimeZoneInformation GetLocaleInfoW GetTickCount OutputDebugStringA SetEvent WaitForMultipleObjectsEx RaiseException MultiByteToWideChar InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection GetSystemTimeAsFileTime DecodePointer EncodePointer InitializeCriticalSectionEx QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx SetCurrentDirectoryW FindFirstFileExW InitOnceBeginInitialize InitOnceComplete GetStringTypeW

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

401KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_89135cd540335cbcfbd9785bd58ce8ee_glassworm_icedid_luca-stealer_njrat_stealc

discord-rpc.x64

steam_api64

shell32

advapi32

user32

kernel32

generic