2026-08-19_c70006a1266f7db1c2617d09a3e07ed3_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_c70006a1266f7db1c2617d09a3e07ed3_glassworm_icedid_luca-stealer_njrat_stealc
Size 3.0MB
Sample260819-e1t5ladm9x
SHA256 1fe6b32759dd5ea31e313f7cdbafa9bc638d6fd1f5724486df35eeed20fb24f3
MD5 c70006a1266f7db1c2617d09a3e07ed3
SHA1 8991fb009997658856a432f8385eb285b4bc79e3
SHA512 01446cf9bd1f70b2db27dfd3615e9df7166a7900385673830810346ffb2ba7e8d55d6297b7fbcbcd1563757e0dc18e98a8b5a27ab690710e552c9f670cd764c1
SSDEEP 49152:HIQY2cWH+t/KcAXvgTOtiZLNHQLLzuwy9KtIzHUdrDmFQVA:QsoBctUUdba
TLSH
T1C8E59D66A3A901ACD0A7C174CE465947D7B2B44613B28FDF53D09EAA1F137B11E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_c70006a1266f7db1c2617d09a3e07ed3_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-19_c70006a1266f7db1c2617d09a3e07ed3_glassworm_icedid_luca-stealer_njrat_stealc

.exe 3.0MB

2026-08-19_c70006a1266f7db1c2617d09a3e07ed3_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH c4af6fe2f5e5f59bcf0c2c9c79adeb71
SHA256 1fe6b32759dd5ea31e313f7cdbafa9bc638d6fd1f5724486df35eeed20fb24f3
MD5 c70006a1266f7db1c2617d09a3e07ed3
SHA1 8991fb009997658856a432f8385eb285b4bc79e3
SHA512 01446cf9bd1f70b2db27dfd3615e9df7166a7900385673830810346ffb2ba7e8d55d6297b7fbcbcd1563757e0dc18e98a8b5a27ab690710e552c9f670cd764c1
SSDEEP 49152:HIQY2cWH+t/KcAXvgTOtiZLNHQLLzuwy9KtIzHUdrDmFQVA:QsoBctUUdba
TLSH
T1C8E59D66A3A901ACD0A7C174CE465947D7B2B44613B28FDF53D09EAA1F137B11E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1270044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCrackUrl WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders

crypt32

CryptUnprotectData CryptStringToBinaryA CryptBinaryToStringA

bcrypt

BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptEncrypt BCryptSetProperty BCryptHashData BCryptDestroyKey BCryptDecrypt BCryptDestroyHash BCryptFinishHash BCryptCreateHash BCryptOpenAlgorithmProvider

iphlpapi

GetAdaptersInfo

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlPcToFileHeader RtlInitUnicodeString RtlUnwindEx RtlUnwind

shell32

ShellExecuteA

user32

GetWindowRect GetForegroundWindow GetAsyncKeyState GetKeyboardLayout GetWindowThreadProcessId ReleaseDC GetDC GetSystemMetrics MessageBoxA ToUnicodeEx

advapi32

RegCloseKey CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash RegQueryValueExA RegOpenKeyExA GetUserNameW RegQueryValueExW RegOpenKeyExW CryptAcquireContextW

gdi32

BitBlt CreateCompatibleDC DeleteDC DeleteObject SelectObject CreateDIBSection

kernel32

ReadConsoleW SetFilePointerEx IsValidCodePage GetACP GetConsoleMode GetOEMCP GetModuleHandleExW FreeLibraryAndExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW GetModuleFileNameW GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetConsoleOutputCP DeleteFileW GetLastError Sleep ExitProcess CreateFileW FindClose FindFirstFileW FindNextFileW ReadFile WriteFile GetTempPathA CloseHandle ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW GetCurrentProcessId CreateProcessW GetTickCount LocalFree GetFileAttributesExW GetTempPathW GetFileAttributesW FreeLibrary GetProcAddress LoadLibraryW SetDllDirectoryW CreateDirectoryA CreateFileA GetDiskFreeSpaceExW SetUnhandledExceptionFilter CreateMutexA ExitThread GlobalMemoryStatusEx GetTickCount64 GetNativeSystemInfo LoadResource LockResource SizeofResource FindResourceA GetComputerNameW GetSystemInfo GetVersionExA GetTimeZoneInformation GetSystemTime GetEnvironmentVariableA GetFileSizeEx OutputDebugStringA CreateFileMappingW MapViewOfFile UnmapViewOfFile MultiByteToWideChar WideCharToMultiByte OpenProcess QueryFullProcessImageNameW FlushFileBuffers QueryPerformanceCounter FormatMessageA GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx CreateFileMappingA UnlockFile HeapDestroy HeapCompact HeapAlloc HeapReAlloc TerminateProcess DeleteFileA WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate GetVersionExW WaitForSingleObject CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId GetCurrentProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetLocaleInfoEx CreateDirectoryW FindFirstFileExW GetFinalPathNameByHandleW SetFileInformationByHandle GetModuleHandleW GetFileInformationByHandleEx InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead CompareStringW

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

87KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

109KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_c70006a1266f7db1c2617d09a3e07ed3_glassworm_icedid_luca-stealer_njrat_stealc

winhttp

crypt32

bcrypt

iphlpapi

ntdll

shell32

user32

advapi32

gdi32

kernel32

generic