2026-08-09_1307e505d8b82c8eec0013b7ac08a022_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_1307e505d8b82c8eec0013b7ac08a022_glassworm_icedid_luca-stealer_njrat_stealc
Size 10.7MB
Sample260809-xf8flatfja
SHA256 19592eaecba1ee6e489a177897fa82bbd764e7a9c76c62ebfc159c938b5cf90f
MD5 1307e505d8b82c8eec0013b7ac08a022
SHA1 d139918233b084c5a8e0cc6458c6ecb9744dfea6
SHA512 dc3e7371e5c90b7601862f90d1b7800bcf08b346813515f4821b141d62591dc224f8d1f263cc513be0e50204f4dcf65e89b72a60dfd2a7fc238e4bc358c0f956
SSDEEP 98304:M6qDDvhBwgK4SLveA6asy2Af4hjfOnN2lt/nioCLyWaQjl2rTTJ6CYVt63PJI/Vp:M0RFv561AOnETUQCY2xUVI9
TLSH
T12AB6010BB3AA85DDE1925078C68EB7639230B424173673DBE6E10955AF573EC5EBCB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_1307e505d8b82c8eec0013b7ac08a022_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-09_1307e505d8b82c8eec0013b7ac08a022_glassworm_icedid_luca-stealer_njrat_stealc

.exe 10.7MB

2026-08-09_1307e505d8b82c8eec0013b7ac08a022_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH c9cb43d7deb4595385d574d30356fb8f
SHA256 19592eaecba1ee6e489a177897fa82bbd764e7a9c76c62ebfc159c938b5cf90f
MD5 1307e505d8b82c8eec0013b7ac08a022
SHA1 d139918233b084c5a8e0cc6458c6ecb9744dfea6
SHA512 dc3e7371e5c90b7601862f90d1b7800bcf08b346813515f4821b141d62591dc224f8d1f263cc513be0e50204f4dcf65e89b72a60dfd2a7fc238e4bc358c0f956
SSDEEP 98304:M6qDDvhBwgK4SLveA6asy2Af4hjfOnN2lt/nioCLyWaQjl2rTTJ6CYVt63PJI/Vp:M0RFv561AOnETUQCY2xUVI9
TLSH
T12AB6010BB3AA85DDE1925078C68EB7639230B424173673DBE6E10955AF573EC5EBCB00
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1685816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse

kernel32

IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentProcess ExitProcess GetCurrentThread SetThreadPriority SetPriorityClass GetPriorityClass GetThreadContext OpenProcess GetTickCount64 WriteProcessMemory GetModuleHandleA GetProcAddress AllocConsole GetConsoleMode SetConsoleMode SetConsoleOutputCP SetConsoleTitleA MapViewOfFile OpenFileMappingA GetLocalTime GetFileAttributesA GetModuleFileNameA LoadResource LockResource SizeofResource FindResourceA MultiByteToWideChar GetModuleHandleExA GetLastError WaitForSingleObject GetExitCodeProcess CreateRemoteThread GetExitCodeThread VirtualAllocEx ReadProcessMemory CreateToolhelp32Snapshot Process32First Process32Next K32EnumProcessModulesEx K32GetModuleBaseNameA K32GetModuleInformation VirtualFreeEx LoadLibraryA DuplicateHandle TerminateThread GetProcessId GetSystemInfo VirtualQueryEx GetEnvironmentVariableW CreateDirectoryW CreateFileW FlushFileBuffers WriteFile GetTempPathW OutputDebugStringA OutputDebugStringW SetUnhandledExceptionFilter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetModuleFileNameW GetModuleHandleExW WideCharToMultiByte K32EnumProcessModules VirtualProtectEx Module32FirstW Module32NextW SwitchToThread GetTickCount FreeLibrary LoadLibraryExA K32GetModuleFileNameExA CreateFileA GetFileSize ReadFile GetTempPathA CreateThread GlobalAlloc GlobalUnlock GetCommandLineW GlobalFree GetFileSizeEx GetCommandLineA GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx InitializeSListHead TerminateProcess GetStartupInfoW UnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer GetStdHandle SetFilePointerEx ReadConsoleW GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize SetEndOfFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection IsProcessorFeaturePresent CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns RaiseException SleepConditionVariableSRW WakeAllConditionVariable InitOnceComplete InitOnceBeginInitialize GetFileInformationByHandleEx MoveFileExW CopyFileW GetModuleHandleW AreFileApisANSI SetFileInformationByHandle HeapReAlloc IsValidCodePage GetACP GetConsoleOutputCP GetOEMCP WriteConsoleW GlobalLock WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle

user32

DispatchMessageA PeekMessageA DefWindowProcA PostQuitMessage RegisterClassExA CreateWindowExA DestroyWindow ShowWindow TranslateMessage GetAsyncKeyState GetLastInputInfo GetForegroundWindow wsprintfA SetLayeredWindowAttributes SetWindowPos SetWindowDisplayAffinity IsWindowVisible IsIconic UpdateWindow SetForegroundWindow GetClientRect GetKeyNameTextA MapVirtualKeyA GetWindowThreadProcessId SendInput FindWindowA GetSystemMetrics CloseClipboard ClientToScreen LoadCursorA ScreenToClient GetCursorPos SetCursor SetCursorPos ReleaseCapture SetCapture GetCapture GetKeyState TrackMouseEvent EmptyClipboard GetClipboardData SetClipboardData GetWindowLongPtrA OpenClipboard SetWindowLongPtrA mouse_event

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueA RegQueryValueExA RegOpenKeyExA RegCloseKey RegGetValueA

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoCreateInstance CoInitializeEx CoUninitialize

winmm

timeBeginPeriod waveOutWrite waveOutUnprepareHeader waveOutPrepareHeader waveOutClose waveOutOpen timeEndPeriod

ntdll

RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

dbghelp

SymFromAddr MiniDumpWriteDump SymFunctionTableAccess64 SymInitialize SymGetModuleBase64 SymCleanup SymSetOptions StackWalk64

urlmon

URLDownloadToFileA

imm32

ImmGetContext ImmReleaseContext ImmAssociateContextEx ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ChamsMa

Size

512B

Virtual Size

355B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ChamsHo

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1023KB

Virtual Size

1022KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.6MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_1307e505d8b82c8eec0013b7ac08a022_glassworm_icedid_luca-stealer_njrat_stealc

d3d11

dwmapi

winhttp

kernel32

user32

advapi32

shell32

ole32

winmm

ntdll

dbghelp

urlmon

imm32

d3dcompiler_47

generic