2026-08-08_b84167c684fbd00c5c48d0aad65c380d_glassworm_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_b84167c684fbd00c5c48d0aad65c380d_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 13.2MB
Sample260808-dcdl9sgl7t
SHA256 0ac9a2e89a2c61ea2a613028ba954bc35acb0f99ea6af82c3187824e5b806978
MD5 b84167c684fbd00c5c48d0aad65c380d
SHA1 0c802d3548359e7813096cb542676903bff8d624
SHA512 ef8c0f52d925b6a58d4de58a3d714b3cbd53802ba2eceb45d02e135f8106292e2283c83ee3ce9dbb90e81427e8607cf96c503a4d21d2c7313276b16cd9677d63
SSDEEP 98304:YUWc6ndSKCm7GGOp09KXTqUrRKPHmps62trZZBbChgHohog/pzjyUnu:YUW/RCjG00UXTvrYE/2trZPChgISYz
TLSH
T170E68D62669D4A9DE067B138C9875207EBF17C081320CFEB55D08D6B5E3FAD0B93A319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_b84167c684fbd00c5c48d0aad65c380d_glassworm_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-08-08_b84167c684fbd00c5c48d0aad65c380d_glassworm_icedid_luca-stealer_njrat_stealc_vidar

.exe 13.2MB

2026-08-08_b84167c684fbd00c5c48d0aad65c380d_glassworm_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 3db9e3bc7a060e921fddd1390a122c01
SHA256 0ac9a2e89a2c61ea2a613028ba954bc35acb0f99ea6af82c3187824e5b806978
MD5 b84167c684fbd00c5c48d0aad65c380d
SHA1 0c802d3548359e7813096cb542676903bff8d624
SHA512 ef8c0f52d925b6a58d4de58a3d714b3cbd53802ba2eceb45d02e135f8106292e2283c83ee3ce9dbb90e81427e8607cf96c503a4d21d2c7313276b16cd9677d63
SSDEEP 98304:YUWc6ndSKCm7GGOp09KXTqUrRKPHmps62trZZBbChgHohog/pzjyUnu:YUW/RCjG00UXTvrYE/2trZPChgISYz
TLSH
T170E68D62669D4A9DE067B138C9875207EBF17C081320CFEB55D08D6B5E3FAD0B93A319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13968384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

CheckRemoteDebuggerPresent CloseHandle SetHandleInformation GetLastError CreatePipe WaitForSingleObject CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId ExitProcess GetCurrentThread CreateProcessA GetThreadContext VirtualProtect ReadProcessMemory CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW lstrcpyA lstrcatA QueryFullProcessImageNameW K32GetModuleInformation CreateToolhelp32Snapshot Process32FirstW Process32NextW HeapAlloc HeapFree GetProcessHeap LocalFree GetTickCount FlushFileBuffers ReadFile ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW DuplicateHandle CreateMutexA CreateThread TerminateThread OpenProcess GetSystemInfo VirtualQueryEx CreateFileMappingA GetSystemTimeAsFileTime WinExec GetVolumeInformationA Beep GetTickCount64 GetFileSizeEx HeapReAlloc SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsDebuggerPresent IsValidCodePage FindFirstFileExW GetTimeZoneInformation GetFileAttributesExW GetExitCodeProcess CreateFileA ReadConsoleW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc OutputDebugStringW GetCommandLineW GetCommandLineA FreeLibraryAndExitThread ExitThread CreateProcessW WriteConsoleW GetModuleHandleExW GetModuleFileNameW GetFileType GetStdHandle LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetLastError RtlPcToFileHeader RtlUnwindEx GetStringTypeW GetCPInfo CompareStringEx GetTempPathA WriteFile GetFileAttributesA FindNextFileW CreateDirectoryA GetEnvironmentVariableW GetEnvironmentVariableA IsDBCSLeadByte GetLocaleInfoA LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter VerSetConditionMask SetEndOfFile WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection FindFirstFileW FindClose DeleteFileA GetACP CreateFileW LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionEx TryAcquireSRWLockExclusive GlobalUnlock GlobalAlloc OutputDebugStringA HeapSize SetFilePointerEx InitializeSListHead GetCurrentThreadId GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive RaiseException VirtualQuery LoadLibraryExA ReleaseSRWLockExclusive

user32

UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetLayeredWindowAttributes SetWindowPos SetFocus UpdateWindow PostQuitMessage OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo DefWindowProcW PostMessageW GetCapture SetCapture ReleaseCapture IsWindowUnicode GetForegroundWindow GetDC ReleaseDC GetClientRect SetCursorPos SetCursor GetCursorPos ClientToScreen ScreenToClient LoadCursorW SetProcessDPIAware GetSystemMetrics GetWindowRect wsprintfW TranslateMessage DispatchMessageW GetKeyState SetWindowLongPtrW SetActiveWindow GetAsyncKeyState MonitorFromPoint FindWindowW SetForegroundWindow GetWindowLongPtrW MessageBoxA PeekMessageW

gdi32

GetDeviceCaps

advapi32

CryptHashData AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid LookupPrivilegeValueW AdjustTokenPrivileges CryptDestroyHash CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextW SetSecurityInfo OpenProcessToken

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

winmm

PlaySoundA

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

bcrypt

BCryptDestroyHash BCryptEncrypt BCryptHashData BCryptCreateHash BCryptFinalizeKeyPair BCryptFinishHash BCryptGenRandom BCryptCloseAlgorithmProvider BCryptExportKey BCryptGenerateKeyPair BCryptDestroyKey BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptGetProperty BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt

crypt32

CryptImportPublicKeyInfoEx2 CryptBinaryToStringA CryptStringToBinaryA CryptDecodeObjectEx

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

Name

.text

Size

7.2MB

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.1337

Size

512B

Virtual Size

61B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

46KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_b84167c684fbd00c5c48d0aad65c380d_glassworm_icedid_luca-stealer_njrat_stealc_vidar

d3d11

kernel32

user32

gdi32

advapi32

shell32

ole32

imm32

dwmapi

winmm

ntdll

bcrypt

crypt32

winhttp

generic