2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc
Size 1.4MB
Sample260810-3q9pasbc49
SHA256 82f60e269143265a73201eb63e44fd50f75690823079ef6c3635b1925083e6f4
MD5 877f2eeae1370b2d166d16fdba494b93
SHA1 9bff5fab22a687cf0d63c534b4c1f7c0344cb8d2
SHA512 b9830d10092c833b5f92072067bad15eec2edea7b5e319096005101005dca232644bdf8cf1b118dff070d4fd67b10b6136c097efd18f1b110f2add807172cb80
SSDEEP 24576:oR2tN7JN2dv9V13b95qWv9YQPZWuipzQPI9hAH8CzQgAqvuG:oR2tjNW96+5kzQPm6YgA0uG
TLSH
T1AE65C01AF6A812FDD076C37ECD565941FA72781657209BCF03A0465B2E2BAE44F3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc

.exe 1.4MB

2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 4ae16397bedd7e5f77e7d2778a128794
SHA256 82f60e269143265a73201eb63e44fd50f75690823079ef6c3635b1925083e6f4
MD5 877f2eeae1370b2d166d16fdba494b93
SHA1 9bff5fab22a687cf0d63c534b4c1f7c0344cb8d2
SHA512 b9830d10092c833b5f92072067bad15eec2edea7b5e319096005101005dca232644bdf8cf1b118dff070d4fd67b10b6136c097efd18f1b110f2add807172cb80
SSDEEP 24576:oR2tN7JN2dv9V13b95qWv9YQPZWuipzQPI9hAH8CzQgAqvuG:oR2tjNW96+5kzQPm6YgA0uG
TLSH
T1AE65C01AF6A812FDD076C37ECD565941FA72781657209BCF03A0465B2E2BAE44F3E702
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

415984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\a\_work\1\s\x64\Release\PowerToys.AlwaysOnTop.pdb

winmm

PlaySoundW

dbghelp

SymGetModuleBase64 SymGetSymFromAddr64 SymInitialize SymGetLineFromAddr64 StackWalk64 SymFunctionTableAccess64 SymSetOptions

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

kernel32

DecodePointer CloseHandle SetEvent HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap OpenProcess QueryFullProcessImageNameW GetCurrentProcess CreateEventW SetLastError WaitForSingleObject GetModuleFileNameW RtlCaptureContext GetCurrentThread SetUnhandledExceptionFilter CreateMutexW GetCurrentThreadId GetModuleFileNameA CreateSemaphoreExW ReleaseSemaphore GetModuleHandleExW ReleaseMutex FormatMessageW OutputDebugStringW WaitForSingleObjectEx OpenSemaphoreW GetProcAddress CreateMutexExW GetCurrentProcessId GetModuleHandleW WideCharToMultiByte DebugBreak IsDebuggerPresent IsValidCodePage GetTimeZoneInformation ReadConsoleW FindResourceExW ReadFile SetFilePointerEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc ExitProcess DeleteFileW GetFileType SetStdHandle SetConsoleCtrlHandler FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SizeofResource LoadResource LockResource DeleteCriticalSection InitializeCriticalSectionEx GetLastError GetACP GetOEMCP RtlUnwind GetSystemTimePreciseAsFileTime GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW TerminateProcess UnhandledExceptionFilter SetEndOfFile RtlVirtualUnwind RtlLookupFunctionEntry GetFileSizeEx RaiseException GetFileTime GetCPInfo WriteConsoleW GetDynamicTimeZoneInformation GetFileAttributesW MultiByteToWideChar Sleep GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle WriteConsoleA WriteFile GetConsoleMode SetEnvironmentVariableW OutputDebugStringA CloseThreadpoolIo AcquireSRWLockExclusive TryAcquireSRWLockShared CreateFileW CancelIoEx GetOverlappedResult WaitForThreadpoolIoCallbacks StartThreadpoolIo ReadDirectoryChangesW CancelThreadpoolIo CreateThreadpoolIo ReleaseSRWLockShared ReleaseSRWLockExclusive K32GetModuleFileNameExW FormatMessageA LocalFree GetLocaleInfoEx GetExitCodeThread CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetTickCount64 EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetSystemTimeAsFileTime

user32

SetCursor SetLayeredWindowAttributes GetSystemMetrics LoadCursorW PostMessageW GetKeyNameTextW ToUnicodeEx MapVirtualKeyExW GetKeyboardLayout KillTimer GetMessageW SetTimer ShowWindow SetWindowPos GetPropW GetWindowLongW DestroyWindow SetWinEventHook MonitorFromWindow RegisterWindowMessageW RegisterHotKey UnregisterHotKey EnumWindows GetWindowTextLengthW IsWindowVisible GetForegroundWindow CreateWindowExW RegisterClassExW EnumChildWindows GetWindowThreadProcessId TranslateMessage PeekMessageW UnregisterClassW DispatchMessageW LoadStringW CharUpperBuffW GetWindowTextW DefWindowProcW SetWindowLongPtrW GetWindowLongPtrW RemovePropW SetPropW MessageBoxW SetProcessDpiAwarenessContext PostThreadMessageW MsgWaitForMultipleObjects

gdi32

CreateRectRgn DeleteObject

advapi32

RegCloseKey GetTokenInformation RegGetValueW EventWriteTransfer EventSetInformation EventRegister EventUnregister OpenProcessToken RegQueryValueExW EnableTraceEx2 ControlTraceW StartTraceW RegOpenKeyExW

shell32

SHGetKnownFolderPath SHQueryUserNotificationState

ole32

CoInitializeEx CoCreateFreeThreadedMarshaler CoCreateInstance CoTaskMemFree CLSIDFromString

d2d1

ord1

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

oleaut32

SysFreeString GetErrorInfo SetErrorInfo SysStringLen

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

599KB

Virtual Size

599KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

175KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc

winmm

dbghelp

dwmapi

kernel32

user32

gdi32

advapi32

shell32

ole32

d2d1

api-ms-win-shcore-scaling-l1-1-1

oleaut32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic