2026-08-12_c9170f97933686f64750b8ea3e0901cc_glassworm_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_c9170f97933686f64750b8ea3e0901cc_glassworm_icedid_njrat_stealc
Size 4.0MB
Sample260812-e1xwgsydpc
SHA256 778987a85133fae8af65d60ec07fc5b316d03778a3db70cf3a3e33abf99c0d14
MD5 c9170f97933686f64750b8ea3e0901cc
SHA1 e3f4c758f56bb494facc517e6b6b054c885b313d
SHA512 1d26222a95a7fb960abc3dbed8307c946ee2d382dcc049f1a9e52df42c2ff6f75bb100724bcae5c664ed1f11702491db541b30abade633fd05861a50f6c0e2f3
SSDEEP 49152:mBSz4NDQmkMOLnFcewp5wKsHGMw4tnHwkXAjcydtbrPumwaGeWrn4/EIXz/TErlK:6DGXtnHw+UntbrPfEIH
TLSH
T1A7169E57B3E80499E027A038DB425D0BE2717419036097EB7FD449A94FBFAE0DB7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_c9170f97933686f64750b8ea3e0901cc_glassworm_icedid_njrat_stealc

File Explorer

2026-08-12_c9170f97933686f64750b8ea3e0901cc_glassworm_icedid_njrat_stealc

.exe 4.0MB

2026-08-12_c9170f97933686f64750b8ea3e0901cc_glassworm_icedid_njrat_stealc

IMPHASH 0af91cc273945d005a484eef1dcbe7a0
SHA256 778987a85133fae8af65d60ec07fc5b316d03778a3db70cf3a3e33abf99c0d14
MD5 c9170f97933686f64750b8ea3e0901cc
SHA1 e3f4c758f56bb494facc517e6b6b054c885b313d
SHA512 1d26222a95a7fb960abc3dbed8307c946ee2d382dcc049f1a9e52df42c2ff6f75bb100724bcae5c664ed1f11702491db541b30abade633fd05861a50f6c0e2f3
SSDEEP 49152:mBSz4NDQmkMOLnFcewp5wKsHGMw4tnHwkXAjcydtbrPumwaGeWrn4/EIXz/TErlK:6DGXtnHw+UntbrPfEIH
TLSH
T1A7169E57B3E80499E027A038DB425D0BE2717419036097EB7FD449A94FBFAE0DB7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

367468

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmSetWindowAttribute

bcrypt

BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData

kernel32

RaiseException SetUnhandledExceptionFilter QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId CreateThread GetCurrentThread GetCurrentThreadId GetTickCount GetModuleFileNameW GetModuleHandleW GetModuleHandleExW GetProcAddress CreateFileW GetFileSizeEx ReadFile LoadResource LockResource SizeofResource FindResourceW WideCharToMultiByte GetFileAttributesA TerminateThread MapViewOfFile UnmapViewOfFile CreateFileMappingA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar FreeLibrary LoadLibraryA GetLocaleInfoA FindClose FindFirstFileW FindNextFileW K32GetModuleFileNameExW OpenFileMappingA FlushFileBuffers WriteFile GetEnvironmentVariableA CreateDirectoryA GetModuleFileNameA GetEnvironmentVariableW GetTempPathW GetLocalTime FlushInstructionCache VirtualAllocEx VirtualFreeEx DeleteFileW GetWindowsDirectoryW GetDriveTypeW GetFileSize IsDebuggerPresent SetFilePointer SetFileTime ExitProcess GetExitCodeProcess CreateRemoteThread GetExitCodeThread CreateProcessW SetProcessMitigationPolicy GetSystemTimeAsFileTime GetSystemDirectoryW CreateFileMappingW IsWow64Process LoadLibraryW CopyFileW K32GetProcessMemoryInfo RtlUnwindEx RtlPcToFileHeader InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW DecodePointer EncodePointer WakeAllConditionVariable DeleteCriticalSection InitializeCriticalSectionEx SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree GetFileAttributesW Process32NextW Process32FirstW CreateToolhelp32Snapshot WriteProcessMemory ReadProcessMemory VirtualProtect OpenProcess LeaveCriticalSection EnterCriticalSection SetLastError GetLastError CloseHandle GetConsoleOutputCP GetConsoleMode ReadConsoleW SetFilePointerEx HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize SetEndOfFile WriteConsoleW GetLogicalDrives RtlUnwind LCMapStringW

user32

PeekMessageA DispatchMessageA MessageBoxA GetWindowRect SetProcessDPIAware ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetForegroundWindow MessageBoxW GetAsyncKeyState GetWindowLongPtrW IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetWindow GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadCursorW SetForegroundWindow BringWindowToTop SetWindowDisplayAffinity SetWindowPos ShowWindow DestroyWindow IsWindow CreateWindowExA RegisterClassExA UnregisterClassA DefWindowProcA TranslateMessage GetSystemMetrics GetWindowThreadProcessId EnumWindows GetClientRect IsWindowVisible EmptyClipboard UpdateWindow

gdi32

CreateSolidBrush

advapi32

RegCloseKey RegQueryValueExA LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegOpenKeyExA

shell32

SHGetFolderPathA

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

518KB

Virtual Size

517KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_c9170f97933686f64750b8ea3e0901cc_glassworm_icedid_njrat_stealc

d3d11

dwmapi

bcrypt

kernel32

user32

gdi32

advapi32

shell32

imm32

generic