2026-08-05_7b83b761fdb0086d19d8c7cf341b039f_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_7b83b761fdb0086d19d8c7cf341b039f_glassworm_icedid_luca-stealer_njrat_stealc
Size 12.3MB
Sample260805-endbbaan3t
SHA256 74d4a7d0f7d862e593076a03d3304241b5895ba8aa16fec2b988db372652a754
MD5 7b83b761fdb0086d19d8c7cf341b039f
SHA1 d0fe72308f2639ca9351c5b22b471fd6bf590818
SHA512 47474ccb0b33689ef5ad11492803a7fd6ebb148b5c899565b6ccdd845bac4b895d38853fc403e7abedf5c754be325d97211ab6314d31296d6f9fadc3b684159e
SSDEEP 196608:QVVoo0/ku5/JvhVgj4rpz8A8PqEeKGWMW/vDQHi8LnCORsOJvZ+:QTsvh6489eNWMM4NRRssvZ+
TLSH
T11ED6122AF2648579C137D235C9024117FA3638CAD732A0DF77F4098A5EA36D4877ABB4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_7b83b761fdb0086d19d8c7cf341b039f_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-05_7b83b761fdb0086d19d8c7cf341b039f_glassworm_icedid_luca-stealer_njrat_stealc

.exe 12.3MB

2026-08-05_7b83b761fdb0086d19d8c7cf341b039f_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 93b5498c47dc33d666ea4cb621248593
SHA256 74d4a7d0f7d862e593076a03d3304241b5895ba8aa16fec2b988db372652a754
MD5 7b83b761fdb0086d19d8c7cf341b039f
SHA1 d0fe72308f2639ca9351c5b22b471fd6bf590818
SHA512 47474ccb0b33689ef5ad11492803a7fd6ebb148b5c899565b6ccdd845bac4b895d38853fc403e7abedf5c754be325d97211ab6314d31296d6f9fadc3b684159e
SSDEEP 196608:QVVoo0/ku5/JvhVgj4rpz8A8PqEeKGWMW/vDQHi8LnCORsOJvZ+:QTsvh6489eNWMM4NRRssvZ+
TLSH
T11ED6122AF2648579C137D235C9024117FA3638CAD732A0DF77F4098A5EA36D4877ABB4
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables (downlaoders) containing URLs to raw contents of a paste
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

321460

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\bagma\Desktop\FUSION with Lag - Copy\fusion-plus\fusion-injector\build\fusion-injector.pdb

d3d9

Direct3DCreate9

user32

ReleaseCapture IsWindowUnicode GetClientRect SetCapture SetClipboardData GetClipboardData EmptyClipboard CloseClipboard GetCursorPos SetCursorPos SetCursor PostMessageW LoadCursorW GetWindowLongW DefWindowProcW CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW TranslateMessage LoadIconW SetWindowLongW PostQuitMessage UpdateWindow GetForegroundWindow MessageBoxA GetWindowThreadProcessId GetWindowTextLengthW IsWindowVisible GetWindowTextA EnumWindows GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout OpenClipboard

shell32

SHGetFolderPathA ShellExecuteW

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetFileSizeEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx ExitProcess GetModuleFileNameW WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread SetStdHandle GetProcessHeap HeapReAlloc CreateThread ReadFile LoadLibraryExW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter SizeofResource FindResourceA GetTempPathA GetLastError LockResource LoadResource GetLocalTime GetCurrentDirectoryW GetCurrentProcessId WriteProcessMemory WaitForSingleObject OpenProcess CreateToolhelp32Snapshot CloseHandle Module32FirstW VirtualAllocEx CreateRemoteThread Module32NextW VirtualFreeEx Sleep GetModuleHandleW SetUnhandledExceptionFilter TlsFree HeapSize WriteConsoleW SetEndOfFile InitializeSListHead TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId GetSystemTimeAsFileTime RtlUnwind IsDebuggerPresent GetStartupInfoW TryAcquireSRWLockExclusive LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx InitializeCriticalSectionEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

winhttp

WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

Name

.text

Size

501KB

Virtual Size

500KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

138KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11.7MB

Virtual Size

11.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_7b83b761fdb0086d19d8c7cf341b039f_glassworm_icedid_luca-stealer_njrat_stealc

d3d9

user32

shell32

kernel32

imm32

winhttp

generic