a57cd031564ca798b0217a46f547cdff2bbdd5500a812827618245acffdfe050

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 08:12

Target
2026-08-16_34ffe4bd5c06d437aefe702c3aef5c9f_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 5.7MB
Sample260816-j4aycatbmd
SHA256 a57cd031564ca798b0217a46f547cdff2bbdd5500a812827618245acffdfe050
MD5 34ffe4bd5c06d437aefe702c3aef5c9f
SHA1 f2a7751e402f708798793474fabb6e9dadbd1c51
SHA512 de30a85f5bb2ffb4e77db90f7e9f5c0e1a8dfb04a30441bcb44d432158e3ea7504d07d5c3c7f9f8f9d09eaed80a5fc1cdd8cf542f31b0b0e0f0ab1a7e88c16d2
SSDEEP 49152:vTjwCCgIJeiEb2tiP5mbtvbFClRGvMsidtLkoY2KLc2Mt1E3TQpts:vICCPEWxvmRGYAQtGC+
TLSH
T18556E85AD6B642E1D4F9D178C626722BFC713C5EC134A70BA781AB175B32760EA3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4576	2026-08-16_34ffe4bd5c06d437aefe702c3aef5c9f_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4576	2026-08-16_34ffe4bd5c06d437aefe702c3aef5c9f_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4576	2026-08-16_34ffe4bd5c06d437aefe702c3aef5c9f_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4576	2026-08-16_34ffe4bd5c06d437aefe702c3aef5c9f_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4576	2026-08-16_34ffe4bd5c06d437aefe702c3aef5c9f_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
4576	2026-08-16_34ffe4bd5c06d437aefe702c3aef5c9f_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-16_34ffe4bd5c06d437aefe702c3aef5c9f_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_34ffe4bd5c06d437aefe702c3aef5c9f_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4576

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

pixel[2].gif

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IPRZA5UK\pixel[2].gif
Size 42B
SHA256 ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
MD5 d89746888da2d9510b64a9f031eaecd5
SHA1 d5fceb6532643d0d84ffe09c40c481ecdf59e15a
SHA512 d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c
MD5 SHA1 SHA512

Submit Download