d3b6f4371584bd6dba8bca534c8b30e55f5cf15d1bf7d71b194079b955c9b7e2

General

Target
2026-08-20_bec07c9a0ab86c60122fc4a76d5e9907_glassworm_icedid_luca-stealer_njrat
Size 6.9MB
Sample260820-3e8ymack5x
SHA256 d3b6f4371584bd6dba8bca534c8b30e55f5cf15d1bf7d71b194079b955c9b7e2
MD5 bec07c9a0ab86c60122fc4a76d5e9907
SHA1 6d9a9abc74eddf969cc248eb560b7ee2703c8041
SHA512 d2adb600912ba332c740e2602ddfa458e1a7573e349d55af52f9060d9d7a00da35ddfbff1d5b4fc91d01d0c42bbc6e2f2671c392605786753125d84b0e63b4f1
SSDEEP 98304:NtBohJI8tjCVjYUG/etL16IU3k4RK/JzDCnNDhTs/gUc3FjpP:Nn6T0xYFetL4U42CNdTsZc3r
TLSH
T1E676E05996A480AFD0B3C1FA47779093E532348633F8E6DB57A044533E227D12A3F67A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-20_bec07c9a0ab86c60122fc4a76d5e9907_glassworm_icedid_luca-stealer_njrat
- Size 6.9MB
- SHA256 d3b6f4371584bd6dba8bca534c8b30e55f5cf15d1bf7d71b194079b955c9b7e2
- MD5 bec07c9a0ab86c60122fc4a76d5e9907
- SHA1 6d9a9abc74eddf969cc248eb560b7ee2703c8041
- SHA512 d2adb600912ba332c740e2602ddfa458e1a7573e349d55af52f9060d9d7a00da35ddfbff1d5b4fc91d01d0c42bbc6e2f2671c392605786753125d84b0e63b4f1
- SSDEEP 98304:NtBohJI8tjCVjYUG/etL16IU3k4RK/JzDCnNDhTs/gUc3FjpP:Nn6T0xYFetL4U42CNdTsZc3r
- TLSH
  T1E676E05996A480AFD0B3C1FA47779093E532348633F8E6DB57A044533E227D12A3F67A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery themida trojan
- Detects executables packed with Enigma
- Detects executables packed with Themida
- Detects executables packed with VMProtect.
- Detects executables referencing many IR and analysis tools
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

5

T1012

System Information Discovery

6

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects executables packed with Enigma

Detects executables packed with Themida

Detects executables packed with VMProtect.

Detects executables referencing many IR and analysis tools

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Checks computer location settings

Executes dropped EXE

Themida packer

Checks installed software on the system

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2