2026-08-09_4d60eee44eb1ae6f16cfcf74f3b82263_elex_glassworm_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_4d60eee44eb1ae6f16cfcf74f3b82263_elex_glassworm_icedid_luca-stealer_njrat
Size 2.5MB
Sample260809-vdmd8ssbnd
SHA256 9694a14117881c6812023da5555f62ff0f463758976ca61e9f4dfd5e378d4800
MD5 4d60eee44eb1ae6f16cfcf74f3b82263
SHA1 a6cf5137f3c7400cae4630485f2ccdadf7a63b07
SHA512 d4b8f68ed8e3b25dcf886bb152803c94eb9b5058a6b846966f67c911df5103f2cdf0c7fdf397d399fc8f88732f64250cafa2abea70102d023c23f1f376841321
SSDEEP 49152:VB6oj15e4w8xhACEKzs57Xci5NLd/uReoDPq3AypQx7sz3tz:yojPJw80Rp7XcO1hYBOwypS7gt
TLSH
T10BC5010377A841A5D0BF8631CB7303C9C73DF846AA99EB8F1A8865951E2B390FD19753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_4d60eee44eb1ae6f16cfcf74f3b82263_elex_glassworm_icedid_luca-stealer_njrat

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/aforge.video.dll
unpack001/sharpdx.direct3d11.dll
unpack001/sharpdx.direct3d9.dll
unpack001/sharpdx.dll
unpack001/sharpdx.dxgi.dll

File Explorer

2026-08-09_4d60eee44eb1ae6f16cfcf74f3b82263_elex_glassworm_icedid_luca-stealer_njrat

.exe 2.5MB
aforge.video.directshow.dll

.dll 71KB
aforge.video.dll

.dll 20KB
dotnetzip.dll

.dll 468KB
sharpdx.direct3d11.dll

.dll 271KB
sharpdx.direct3d9.dll

.dll 338KB
sharpdx.dll

.dll 247KB
sharpdx.dxgi.dll

.dll 125KB

2026-08-09_4d60eee44eb1ae6f16cfcf74f3b82263_elex_glassworm_icedid_luca-stealer_njrat

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9694a14117881c6812023da5555f62ff0f463758976ca61e9f4dfd5e378d4800
MD5 4d60eee44eb1ae6f16cfcf74f3b82263
SHA1 a6cf5137f3c7400cae4630485f2ccdadf7a63b07
SHA512 d4b8f68ed8e3b25dcf886bb152803c94eb9b5058a6b846966f67c911df5103f2cdf0c7fdf397d399fc8f88732f64250cafa2abea70102d023c23f1f376841321
SSDEEP 49152:VB6oj15e4w8xhACEKzs57Xci5NLd/uReoDPq3AypQx7sz3tz:yojPJw80Rp7XcO1hYBOwypS7gt
TLSH
T10BC5010377A841A5D0BF8631CB7303C9C73DF846AA99EB8F1A8865951E2B390FD19753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables manipulated with Fody
Detects executables using Telegram Chat Bot
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

36:f1:04:b0:09:ed:02:fa:e0:3f:3a:a0:c3:f7:66:aa:f9:72:67:39:ff:7d:fd:0b:dc:cc:4f:29:51:80:92:73

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Chains

Jun 10, 2026

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Serial Number

33:00:01:c8:85:97:81:db:fe:9e:90:0f:a2:00:00:00:01:c8:85

Issuer

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 9, 2026 - Jun 12, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:17:27:45:09:0b:8b:87:af:c6:00:00:00:00:00:17

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:56:7e:8f:9d:58:08:8e:e9:60:00:00:00:00:00:56

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

2567294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

aforge.video.directshow.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d789138f067708113636174e74697f7538f2dd49603c46dd3970926519b6c5a8
MD5 428e5480573bdaf15ead6bc7f973d583
SHA1 3c1d4104fe259a78c3beb73d816c32128e7fd3c1
SHA512 2ace6bb7f1376e7d20c3be0ad97d22a11b983da4400dbcb9e52b0b7f085294baa5aa2759e53b02f0750e58b9bcaf816d8764b11b8abedc28a65fa0277333a9eb
SSDEEP 1536:VAbtvEFuhi8r58RK8eTkqjz1g8zQ6tkUC+xQ6:VAKFiBoK8eThn1g8jkUCp6
TLSH
T1FE638E12737CE517D59E4FB574B71B014BB0AA466222E3CE0FB6515C6CB3B808E907A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables manipulated with Fody
Detects executables using Telegram Chat Bot

Digest

94:71:e8:19:72:a9:15:26:20:a1:4d:c5:a4:2f:2b:61:df:74:4a:c4:01:ff:fe:62:1b:34:60:ac:9a:93:76:06

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=准动网络科技（厦门）有限公司,O=准动网络科技（厦门）有限公司,L=厦门市,ST=福建省,C=CN

Chains

Nov 28, 2023

CN=准动网络科技（厦门）有限公司,O=准动网络科技（厦门）有限公司,L=厦门市,ST=福建省,C=CN

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=准动网络科技（厦门）有限公司,O=准动网络科技（厦门）有限公司,L=厦门市,ST=福建省,C=CN

Serial Number

55:5a:2a:66:fd:f3:f2:5f:9b:a2:d8:76

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 31, 2023 - Jul 31, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

66798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

F:\Projects\OpenSource\AForge.NET\Sources\Video.DirectShow\obj\Release\AForge.Video.DirectShow.pdb

aforge.video.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 52616d3438d2c853d69c68dade7bc280a7ffabdc85f1ce4a47166a98343f61b7
MD5 4a48a7428af3f34f8a2e1decf0723da6
SHA1 0f8d9da3c12467e3d2a7e27d6120e337e9b7b585
SHA512 fc319ffa826fc234c19a148810e54a59f80fe7c316d910cd7cc2eb2460d9cd2a564e1bd513192c76c9dbfbf95859f154a22b848e8bfc22e2c401fdda9bc39d63
SSDEEP 384:2tGvUPEoSfESuAGMMOKamweaQIqFS0kklo0KD:p8EoSfVPRZZ0LrKD
TLSH
T1CF92F81D5BACD737CA7E47BAEC6203014770961B3502FB9E7CCDB496AC6339909422A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables manipulated with Fody
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

F:\C#\AForge.NET-master\Sources\Video\obj\Release\AForge.Video.pdb

dotnetzip.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0e52639dbddef74bc32f25555b193ab336e45e2f856d0424b140048c42b097ad
MD5 081c3e4b982ef5f2316bbdd31b324fc2
SHA1 f26053d054bace097d491f12f1503893bd87788f
SHA512 d68ed098de77c8b563ae6fb1f704c042b9ef2f7cf41f89d5ddf9fddf8937485d096052884bbf2ebd2378acdf2bb5686633473e9fc43525e96acaab0b729f3401
SSDEEP 6144:GuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/WK:UQL32ikCaUS4csRBse6sfWK
TLSH
T1A6A4AE0427EC4B57E1EF5BB5E0B69592C3B1B462693EEB8F5D4024EE2C17390C911BA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables manipulated with Fody
Detects executables using Telegram Chat Bot

Digest

13:8b:f6:d8:5e:11:a7:7d:99:23:3f:a2:cf:77:74:08:78:12:2e:73:c4:3d:bf:8e:a7:85:e5:13:b1:43:8d:6a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=IMI.VC Advisors UAB,O=IMI.VC Advisors UAB,L=Vilnius,C=LT

Chains

May 15, 2022

CN=IMI.VC Advisors UAB,O=IMI.VC Advisors UAB,L=Vilnius,C=LT

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=IMI.VC Advisors UAB,O=IMI.VC Advisors UAB,L=Vilnius,C=LT

Serial Number

20:1f:02:bd:af:c5:59:5b:ca:73:61:50:6d:54:27:c0

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 27, 2019 - Nov 19, 2022

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Minor OS version

Major OS version

Entry point

465934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb

sharpdx.direct3d11.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c
MD5 98eb5ba5871acdeaebf3a3b0f64be449
SHA1 c965284f60ef789b00b10b3df60ee682b4497de3
SHA512 a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2
SSDEEP 3072:6ccUvNf/AThDrcfiSDt0XN3ZDoyz91Sy0KwbwgG5OHDyGQsnHZ09K3vJqlQ1VcTS:zRfi+SmNgOHDyGQsucvJqW6Ts4dDjJZ
TLSH
T1F444E612DD465D0FC68F127EB4127A2743B08506489AF76FAC9C8C9E0FE63DC9A1A7C5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables manipulated with Fody
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

283726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Downloads\desktop-duplication-net-master\desktop-duplication-net-master\libs\SharpDX.Direct3D11.pdb

sharpdx.direct3d9.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 02da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7
MD5 934da0e49208d0881c44fe19d5033840
SHA1 a19c5a822e82e41752a08d3bd9110db19a8a5016
SHA512 de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59
SSDEEP 6144:sF8TUNl4RaWH/EgJ2bOVbIbgiSC0EhS/:+8laWsgOOQHS
TLSH
T15B742B216F4AA723C74E2BBB98525D1CC334C202899FEB9F15E894710FC13958E5E6DB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables manipulated with Fody
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

352142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX.Direct3D9\bin\Release\SharpDX.Direct3D9.pdb

sharpdx.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303
MD5 ffb4b61cc11bec6d48226027c2c26704
SHA1 fa8b9e344accbdc4dffa9b5d821d23f0716da29e
SHA512 48aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9
SSDEEP 6144:/yx2FKVw+6LRnencMdWqtFhdpGFfnbJoeeYr:6w+Ienc1qf6bJrd
TLSH
T167348C36DB5C0923CE8E47BEAC67011307F69204E116DB4F3A7564A929CB384AD6E7D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables manipulated with Fody
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

258638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX\bin\Release\SharpDX.pdb

sharpdx.dxgi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf
MD5 2b44c70c49b70d797fbb748158b5d9bb
SHA1 93e00e6527e461c45c7868d14cf05c007e478081
SHA512 faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0
SSDEEP 1536:taSL4xpOaI0PXSgMkPXsHIrPQkrNCivO5Ib6VU3x8w85SMxcnqNojG5JW/UlibAs:taSLYpfI0fTtP8HIbQkreK
TLSH
T1E3C31F8A6F7187B1EA4F6FBE6652B92A6123F1110481735206D534004BB9253CFBFBDE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables manipulated with Fody
Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

134238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX.DXGI\bin\Release\SharpDX.DXGI.pdb

2026-08-09_4d60eee44eb1ae6f16cfcf74f3b82263_elex_glassworm_icedid_luca-stealer_njrat

PE Signature issue

mscoree

dotnet

aforge.video.directshow.dll

mscoree

dotnet

aforge.video.dll

mscoree

dotnet

dotnetzip.dll

mscoree

dotnet

sharpdx.direct3d11.dll

mscoree

dotnet

sharpdx.direct3d9.dll

mscoree

dotnet

sharpdx.dll

mscoree

dotnet

sharpdx.dxgi.dll

mscoree

dotnet