2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc
Size 1.2MB
Sample260815-ch143sdc85
SHA256 eed8c52a07523c6005686c4024a4b3f06bf6b33988d1f9b49823e4c0f3b3f0f8
MD5 f45ab3497fece331ff4d4f7265297639
SHA1 38ec7e72fe0bbb73ebd968742983cc49ed70fdfc
SHA512 5cf75a5cff6c72cbc01d96581aa41626ce22ad8d128e1d1d948c9742d807393836d1367f94670b07d35cefd9502844b9bc553b4a998c5d62a031099a6faab9e7
SSDEEP 24576:P2+XQGb0WKBwDJ0YzZBWz/VLMy46Y/+cbQ5:PzWwDJpPWzNLwk
TLSH
T1DE454B1657D8027CF0F7D2F8DEA69C42DB76780A07B19AEF06C055664E27BA08E39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc

.exe 1.2MB

2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 0bf5343f8db2f2ecede5134a6a982f99
SHA256 eed8c52a07523c6005686c4024a4b3f06bf6b33988d1f9b49823e4c0f3b3f0f8
MD5 f45ab3497fece331ff4d4f7265297639
SHA1 38ec7e72fe0bbb73ebd968742983cc49ed70fdfc
SHA512 5cf75a5cff6c72cbc01d96581aa41626ce22ad8d128e1d1d948c9742d807393836d1367f94670b07d35cefd9502844b9bc553b4a998c5d62a031099a6faab9e7
SSDEEP 24576:P2+XQGb0WKBwDJ0YzZBWz/VLMy46Y/+cbQ5:PzWwDJpPWzNLwk
TLSH
T1DE454B1657D8027CF0F7D2F8DEA69C42DB76780A07B19AEF06C055664E27BA08E39713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d3:fe:9d:81:51:2b:15:28:c9:02:a5:4d:63:ac:c9:d8:0e:ea:89:c2:66:84:fe:7c:62:e4:4b:74:20:af:89:d9

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=AimCore Native Public Signing 2026

Chains

Aug 14, 2026

CN=AimCore Native Public Signing 2026

Minor OS version

Major OS version

Entry point

705264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpSetStatusCallback WinHttpQueryOption WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable

crypt32

CryptUnprotectData CertFindCertificateInStore CryptImportPublicKeyInfoEx2 CryptHashCertificate2 CryptEncodeObjectEx CryptMsgGetParam CryptQueryObject CryptBinaryToStringA CryptStringToBinaryA CertFreeCertificateContext CryptMsgClose CryptDecodeObjectEx CryptProtectData CertCloseStore

wintrust

WinVerifyTrust

shell32

ShellExecuteExW CommandLineToArgvW SHGetKnownFolderPath

ole32

CreateStreamOnHGlobal CoTaskMemFree

advapi32

OpenProcessToken CreateRestrictedToken FreeSid RegOpenKeyExW RegGetValueW CreateProcessAsUserW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW RegCloseKey SetFileSecurityW CryptAcquireContextW EqualSid SetTokenInformation GetSidSubAuthorityCount CryptReleaseContext GetTokenInformation CryptDestroyHash IsValidSid CryptHashData CryptCreateHash CryptGetHashParam CreateProcessWithTokenW ConvertStringSidToSidW LookupPrivilegeNameW GetSidSubAuthority AllocateAndInitializeSid GetLengthSid

kernel32

GetLocaleInfoW IsValidLocale GetUserDefaultLCID GetFileInformationByHandleEx FormatMessageA EnumSystemLocalesW ReadConsoleW HeapReAlloc GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA CreateDirectoryW GetSystemFirmwareTable ReadFile SizeofResource GetVolumeInformationW SetLastError SetDefaultDllDirectories GetCommandLineW GetCurrentProcess WriteFile DeviceIoControl TerminateProcess RemoveDirectoryW GetFinalPathNameByHandleW GetModuleFileNameW CreateNamedPipeW SetEnvironmentVariableW GetProcessId GetNamedPipeClientProcessId CreatePipe SetErrorMode GetEnvironmentVariableW GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW ResumeThread DisconnectNamedPipe OpenProcess SetProcessMitigationPolicy CreateToolhelp32Snapshot CreateEventW MultiByteToWideChar Sleep FormatMessageW GetTickCount64 GetLastError GetEnvironmentStringsW Process32NextW OutputDebugStringW SetEvent GetDiskFreeSpaceExW LockResource GlobalAlloc DeleteFileW Process32FirstW GlobalFree CloseHandle GetNativeSystemInfo HeapSetInformation ResetEvent LoadResource FindResourceW GetLocalTime GetCurrentDirectoryW GetNamedPipeServerProcessId GetWindowsDirectoryW GetProcAddress GlobalLock LocalFree MoveFileExW ExitProcess GetCurrentProcessId SystemTimeToFileTime GlobalMemoryStatusEx CreateProcessW GetModuleHandleW FreeLibrary CopyFileW WideCharToMultiByte QueryFullProcessImageNameW WaitNamedPipeW GlobalUnlock IsWow64Process LoadLibraryExW ConnectNamedPipe SetUnhandledExceptionFilter FlushFileBuffers GetExitCodeProcess AreFileApisANSI SetFileInformationByHandle GetLocaleInfoEx GetFullPathNameW GetFileInformationByHandle FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW LCMapStringW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetFileAttributesExW RtlUnwind CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP HeapFree HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead

user32

GetWindowTextW GetWindowThreadProcessId GetMessageW DefWindowProcW GetKeyState PostMessageW GetWindowRect DestroyWindow IsWindowVisible MessageBoxW MonitorFromWindow SetWindowLongPtrW SetWindowRgn CreateWindowExW ScreenToClient SendMessageW SetWindowTextW GetWindowLongPtrW ShowWindow IsWindow OpenClipboard DispatchMessageW SetTimer GetMonitorInfoW RegisterHotKey EmptyClipboard PeekMessageW RegisterClassW GetForegroundWindow EnumWindows TranslateMessage LoadIconW EnumDisplayDevicesW LoadCursorW GetClassNameW SetClipboardData SetCursor GetClientRect DrawIconEx KillTimer PostQuitMessage SystemParametersInfoW PtInRect UpdateWindow SetForegroundWindow GetAncestor GetCursorPos BeginPaint EndPaint GetRawInputData RegisterRawInputDevices RegisterClassExW CloseClipboard UnregisterHotKey InvalidateRect

gdi32

CreateCompatibleBitmap DeleteObject DeleteDC CreateRoundRectRgn CreateCompatibleDC SelectObject BitBlt

ncrypt

NCryptSignHash BCryptVerifySignature NCryptExportKey NCryptFinalizeKey BCryptDestroyKey NCryptOpenKey BCryptCreateHash BCryptHashData BCryptSignHash BCryptGenRandom NCryptCreatePersistedKey NCryptFreeObject NCryptSetProperty BCryptGetProperty BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptOpenAlgorithmProvider BCryptExportKey BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash NCryptOpenStorageProvider

gdiplus

GdipSetSmoothingMode GdipSetClipPath GdipCreatePath GdipSetStringFormatLineAlign GdipCreateFont GdipSetInterpolationMode GdipCreateSolidFill GdipSetStringFormatTrimming GdipFillPath GdipGraphicsClear GdipDrawLine GdipSetPixelOffsetMode GdipClosePathFigure GdipGetGenericFontFamilySansSerif GdipFree GdipDeletePath GdipDrawString GdipCreateFromHDC GdipFillEllipse GdipSetPenEndCap GdipDrawEllipse GdipCreateLineBrushFromRect GdipAddPathArc GdipDeleteGraphics GdipDrawArc GdipDeleteStringFormat GdipDeleteFont GdipDeletePen GdipCreatePen1 GdipSetStringFormatAlign GdipSetStringFormatFlags GdipAlloc GdipCreateBitmapFromStream GdipDeleteBrush GdipSetPenStartCap GdipCloneImage GdipDrawImageRectRect GdipCreateFontFamilyFromName GdipResetClip GdipSetCompositingQuality GdipDeleteFontFamily GdipCreateStringFormat GdiplusShutdown GdiplusStartup GdipDisposeImage GdipCloneBrush GdipDrawPath

Name

.text

Size

883KB

Virtual Size

883KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

259KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc

PE Signature issue

winhttp

crypt32

wintrust

shell32

ole32

advapi32

kernel32

user32

gdi32

ncrypt

gdiplus

generic