2026-08-16_5090c44c368f47a583fd2a6ce223a1a4_chir_elex_glassworm_icedid_luca-stealer_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_5090c44c368f47a583fd2a6ce223a1a4_chir_elex_glassworm_icedid_luca-stealer_njrat_remcos
Size 452KB
Sample260816-3lfknaztes
SHA256 cca328ef857fed3743678604aad8cd9b6fdd8de282322c8413614fb058f74510
MD5 5090c44c368f47a583fd2a6ce223a1a4
SHA1 7ea2c84ffbba423c01d6a3a19d8c186cc4f792da
SHA512 456f3421a378735251f51e0ce6a407ef12efb95f148ea43b23cb85df60a3b715aa92756ff3cbcd13572873b4d05ffc2614f6aad5e872d2963a263da1175f1c12
SSDEEP 6144:G+ldNRfPkLsvtbwS4kA0SDd2otqpfVbiVdgoJWnSh122pFiMvQZq:GsRfsAJwtkA0SDcoqpfVbivnb/1QZ
TLSH
T117A4AF117A8488B2E17385358DD68666E6BA78200F31C75F1394077E9F37391AE3AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-16_5090c44c368f47a583fd2a6ce223a1a4_chir_elex_glassworm_icedid_luca-stealer_njrat_remcos

File Explorer

2026-08-16_5090c44c368f47a583fd2a6ce223a1a4_chir_elex_glassworm_icedid_luca-stealer_njrat_remcos

.exe 452KB

2026-08-16_5090c44c368f47a583fd2a6ce223a1a4_chir_elex_glassworm_icedid_luca-stealer_njrat_remcos

IMPHASH d5d9ec210ffcdeb0fe31904b91241d0b
SHA256 cca328ef857fed3743678604aad8cd9b6fdd8de282322c8413614fb058f74510
MD5 5090c44c368f47a583fd2a6ce223a1a4
SHA1 7ea2c84ffbba423c01d6a3a19d8c186cc4f792da
SHA512 456f3421a378735251f51e0ce6a407ef12efb95f148ea43b23cb85df60a3b715aa92756ff3cbcd13572873b4d05ffc2614f6aad5e872d2963a263da1175f1c12
SSDEEP 6144:G+ldNRfPkLsvtbwS4kA0SDd2otqpfVbiVdgoJWnSh122pFiMvQZq:GsRfsAJwtkA0SDcoqpfVbivnb/1QZ
TLSH
T117A4AF117A8488B2E17385358DD68666E6BA78200F31C75F1394077E9F37391AE3AB73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

e5:87:4e:43:6f:68:e4:bc:a8:88:df:a5:7c:a7:3a:05:1c:cd:8a:d1

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=The Imaging Source Europe GmbH,O=The Imaging Source Europe GmbH,L=Bremen,ST=Bremen,C=DE,1.2.840.113549.1.9.1=#0c19696e666f40746865696d6167696e67736f757263652e636f6d

Chains

Nov 23, 2016

CN=The Imaging Source Europe GmbH,O=The Imaging Source Europe GmbH,L=Bremen,ST=Bremen,C=DE,1.2.840.113549.1.9.1=#0c19696e666f40746865696d6167696e67736f757263652e636f6d

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=The Imaging Source Europe GmbH,O=The Imaging Source Europe GmbH,L=Bremen,ST=Bremen,C=DE,1.2.840.113549.1.9.1=#0c19696e666f40746865696d6167696e67736f757263652e636f6d

Serial Number

11:21:f6:45:6d:ed:ed:75:5e:a8:7b:52:a3:65:f8:9a:12:5e

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 23, 2015 - Nov 23, 2017

Minor OS version

Major OS version

Entry point

475256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\data\Documents\Development\drvbuildtools\DriverInstaller\bin\Release\drvInstaller.pdb

setupapi

SetupCloseInfFile SetupOpenInfFileW SetupGetStringFieldW SetupFindNextLine SetupFindFirstLineW SetupUninstallOEMInfW SetupCopyOEMInfW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupPromptReboot

comctl32

PropertySheetW CreatePropertySheetPageW ord17

kernel32

ReadFile GetMailslotInfo CreateEventW CreateMailslotW DecodePointer WriteConsoleW SetEndOfFile lstrcpyW HeapSize GetConsoleCP FlushFileBuffers GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FormatMessageW CloseHandle CreateThread GetUserDefaultLangID MultiByteToWideChar FreeConsole AttachConsole VerifyVersionInfoW VerSetConditionMask HeapReAlloc LoadResource FindFirstFileExA GetStringTypeW LCMapStringW ReadConsoleW GetConsoleMode GetLastError GetProcAddress GetModuleHandleW GetCurrentProcess GetModuleFileNameW WaitForSingleObject GetExitCodeProcess GetCommandLineW LocalFree GetTempPathW CreateDirectoryW GetFileAttributesW FindResourceW EnumResourceNamesW CreateFileW WriteFile SizeofResource SetFilePointerEx LockResource FindFirstFileW FindClose FindNextFileW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW EncodePointer RaiseException SetLastError RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetModuleFileNameA WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc GetFileType

user32

SetTimer SetCursor LoadCursorW EnableWindow GetWindowLongW GetSystemMetrics GetClientRect DestroyWindow SetWindowLongW KillTimer GetParent PostMessageW SendMessageW GetDlgItem ReleaseDC GetDC SystemParametersInfoW LoadImageW wsprintfW MessageBoxW CreateWindowExW SetDlgItemTextW

gdi32

GetDeviceCaps DeleteObject CreateFontIndirectW

crypt32

CryptMsgClose CertAddCertificateContextToStore CertOpenStore CertFreeCertificateContext CertCloseStore CryptMsgGetParam CertFindCertificateInStore CryptQueryObject

newdev

UpdateDriverForPlugAndPlayDevicesW

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

shell32

SHFileOperationW CommandLineToArgvW ShellExecuteExW

ole32

StringFromGUID2 CoCreateGuid

Name

.text

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

245KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_5090c44c368f47a583fd2a6ce223a1a4_chir_elex_glassworm_icedid_luca-stealer_njrat_remcos

PE Signature issue

setupapi

comctl32

kernel32

user32

gdi32

crypt32

newdev

advapi32

shell32

ole32

generic