2026-08-04_2a473d1fe38dc7418bec2bca50551ef2_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_2a473d1fe38dc7418bec2bca50551ef2_glassworm_icedid_luca-stealer_njrat_stealc
Size 4.6MB
Sample260804-tvalbsvcmd
SHA256 6474f8767994d4480bab2ee13adf0249c4f7a43a83714d06791ae07ab6596adb
MD5 2a473d1fe38dc7418bec2bca50551ef2
SHA1 f1c5ba58366881c2fff0fb2bf26e5c9485440a8e
SHA512 5d689ba46a57302f9a970b558677608df73a9d5475154809625136b3b8da29ceb7a9d8102ba040ea07de1e6e75cbd68ffb026c0dfd57c330adfbc9e7e458858d
SSDEEP 49152:uuOY1Dc8TxKAUXipLpTMp3sBplX6JSDuJnXiVDrdGmpAzU+DyEvX1d5GFLpAZrF:uuB9cvAexLJSDcXihQmpAIUXf5G0F
TLSH
T14F2625176D64A39DCC2381388DE7DE0EBEF1641B0E6856BE0590C6753EF25B17A2E60C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-04_2a473d1fe38dc7418bec2bca50551ef2_glassworm_icedid_luca-stealer_njrat_stealc

.exe 4.6MB

2026-08-04_2a473d1fe38dc7418bec2bca50551ef2_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 8df6878fa05b0a33c7cd1c05cb9a3a53
SHA256 6474f8767994d4480bab2ee13adf0249c4f7a43a83714d06791ae07ab6596adb
MD5 2a473d1fe38dc7418bec2bca50551ef2
SHA1 f1c5ba58366881c2fff0fb2bf26e5c9485440a8e
SHA512 5d689ba46a57302f9a970b558677608df73a9d5475154809625136b3b8da29ceb7a9d8102ba040ea07de1e6e75cbd68ffb026c0dfd57c330adfbc9e7e458858d
SSDEEP 49152:uuOY1Dc8TxKAUXipLpTMp3sBplX6JSDuJnXiVDrdGmpAzU+DyEvX1d5GFLpAZrF:uuB9cvAexLJSDcXihQmpAIUXf5G0F
TLSH
T14F2625176D64A39DCC2381388DE7DE0EBEF1641B0E6856BE0590C6753EF25B17A2E60C
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

9b:ce:17:83:7a:34:6c:a8:1c:7f:19:e4:c9:e2:61:6a:63:a2:b6:96:96:8d:c9:30:b4:ea:7b:3c:98:d9:44:ad

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=2016-000729393,CN=Janea Systems\, Inc.,O=Janea Systems\, Inc.,STREET=382 NE 191 Street #11630,L=Miami,ST=Florida,C=US,1.3.6.1.4.1.311.60.2.1.2=#130757796f6d696e67,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 20, 2025

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

05:b0:9d:b0:1b:c1:aa:40:00:7c:1f:53

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 13, 2023 - Aug 17, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

209148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\1\s\msvs\x64\RELEASE_DEVELOPER\memurai.pdb

kernel32

WriteFile MultiByteToWideChar LocalFree FreeLibrary LoadLibraryExW K32GetModuleInformation SetFilePointer CreateFileW GetCurrentProcessId GetFullPathNameA SetCurrentDirectoryA GetTickCount64 SetEvent CreateThread CreateEventA VirtualProtect EnterCriticalSection CreateNamedPipeA RegisterWaitForSingleObject VirtualAlloc LeaveCriticalSection InitializeCriticalSection ResumeThread UnmapViewOfFile DuplicateHandle OpenProcess ResetEvent AddVectoredExceptionHandler CreateFileMappingA GlobalMemoryStatusEx DebugBreak MapViewOfFile MapViewOfFileEx VirtualQuery IsDebuggerPresent GetPhysicallyInstalledSystemMemory ReadFile GetSystemTimes GetExitCodeProcess CreateProcessA WaitForSingleObject CopyFileA GetSystemInfo GetCurrentDirectoryA TerminateProcess GetCurrentProcess GetModuleFileNameA DeleteFileA TryAcquireSRWLockExclusive GetStdHandle GetConsoleScreenBufferInfo FindClose FindNextFileA FindFirstFileA CreateFileA Sleep AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock FormatMessageA CreateIoCompletionPort GetProcAddress CloseHandle GetLastError PostQueuedCompletionStatus VirtualFree HeapSize GetProcessHeap FindNextFileW FindFirstFileExW MoveFileExW HeapReAlloc CreateDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetFileSizeEx SetFileAttributesW GetFileAttributesExW DeleteFileW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetTempPathW GetCommandLineW GetCommandLineA GetModuleFileNameW CreatePipe GetConsoleOutputCP ReadConsoleW SetStdHandle FreeLibraryAndExitThread ExitThread GetFullPathNameW SetConsoleCtrlHandler CreateProcessW GetTimeZoneInformation GetCurrentDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW GetModuleHandleExW ExitProcess FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW TlsFree InitializeCriticalSectionAndSpinCount RtlUnwind RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx WideCharToMultiByte GetLocaleInfoEx InitializeSListHead GetModuleHandleA GetModuleHandleW GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry SetConsoleTitleW SetConsoleCursorPosition WriteConsoleW FillConsoleOutputAttribute WriteConsoleInputW ScrollConsoleScreenBufferW FillConsoleOutputCharacterW SetConsoleCursorInfo GetEnvironmentVariableW GetConsoleTitleW GetConsoleCursorInfo SetConsoleTextAttribute SetUnhandledExceptionFilter GetCurrentThread RtlCaptureContext VerifyVersionInfoW VerSetConditionMask GetConsoleMode QueryPerformanceCounter GetSystemTimeAsFileTime QueryPerformanceFrequency GetProcessTimes CreateSemaphoreA DeleteCriticalSection GetCurrentThreadId ReleaseSemaphore TlsSetValue SetLastError TlsAlloc TlsGetValue SetNamedPipeHandleState SetHandleInformation SetEndOfFile GetNamedPipeHandleStateA SetFilePointerEx GetFileType FlushFileBuffers MoveFileExA LoadLibraryA HeapCreate HeapFree HeapAlloc

advapi32

GetNamedSecurityInfoA OpenProcessToken RegOpenKeyExA RegSetValueExA CreateServiceA SetEntriesInAclA StartServiceCtrlDispatcherA QueryServiceStatus CloseServiceHandle SetNamedSecurityInfoA SetServiceStatus OpenSCManagerA RegisterServiceCtrlHandlerExA DeleteService ControlService RegDeleteKeyExA StartServiceA ChangeServiceConfig2A OpenServiceA DeregisterEventSource ReportEventA RegisterEventSourceA RegCreateKeyA RegCloseKey GetTokenInformation

shell32

ShellExecuteExA

bcrypt

BCryptGenRandom

memurai-services

Memurai_license_order_id Memurai_license_max_compatible_version Memurai_license_min_compatible_version Memurai_license_product Memurai_license_id Memurai_services_wait_shutdown Memurai_license_max_ram Memurai_license_organization_id Memurai_license_production_use_allowed Memurai_services_start_shutdown Memurai_license_encrypted Memurai_create_license_reader Memurai_check_license Memurai_license_end_date Memurai_license_shutdown_timer Memurai_license_organization Memurai_services_init Memurai_services_Period_Service Memurai_license_expiration_action Memurai_get_QID Memurai_license_start_date Memurai_n_command Memurai_license_version Memurai_license_created_date Memurai_delete_license_reader Memurai_flush_command Memurai_license_telemetry_status Memurai_license_max_connections Memurai_read_license Memurai_license_distribution_type Memurai_license_max_instances Memurai_license_platform

libcrypto-3-x64

ERR_peek_last_error ERR_reason_error_string OPENSSL_init_crypto OSSL_DECODER_from_fp OPENSSL_cleanup OSSL_DECODER_CTX_new_for_pkey ERR_clear_error OSSL_DECODER_CTX_free ERR_error_string_n BIO_free EVP_PKEY_free BIO_s_mem ERR_get_error PEM_write_bio_X509 BIO_ctrl BIO_new RAND_poll

libssl-3-x64

SSL_CTX_load_verify_locations SSL_CTX_set_cipher_list SSL_CTX_set_verify SSL_ctrl SSL_CTX_set_ciphersuites SSL_CTX_new SSL_CTX_use_PrivateKey_file SSL_CTX_free SSL_new SSL_CTX_set_options SSL_free SSL_CTX_use_certificate_chain_file SSL_CTX_set_timeout SSL_connect SSL_CTX_set_default_passwd_cb TLS_method SSL_CTX_set0_tmp_dh_pkey SSL_CTX_ctrl SSL_set_fd SSL_CTX_set_default_passwd_cb_userdata SSL_accept SSL_pending SSL_read SSL_set_verify SSL_set_accept_state SSL_get1_peer_certificate SSL_shutdown SSL_set_connect_state SSL_get_error SSL_CTX_set_session_id_context SSL_write

ole32

CoCreateGuid

dbghelp

SymGetSymFromAddr64 SymSetOptions StackWalk64 SymInitialize SymFunctionTableAccess64 SymGetLineFromAddr64 SymGetModuleBase64

ws2_32

shutdown

shlwapi

PathRemoveFileSpecA PathRemoveBackslashA PathCombineA PathIsRelativeA

user32

wsprintfW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_2a473d1fe38dc7418bec2bca50551ef2_glassworm_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

shell32

bcrypt

memurai-services

libcrypto-3-x64

libssl-3-x64

ole32

dbghelp

ws2_32

shlwapi

user32

generic