2026-08-19_6ffdd336f8ebcc19f5c7d279e87dc493_glassworm_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_6ffdd336f8ebcc19f5c7d279e87dc493_glassworm_icedid_luca-stealer_njrat
Size 3.0MB
Sample260820-b4f6csxglc
SHA256 bdd8ed23e881143cb0e6dbba8beb4032a8e82762bf27e9c1739cfed0a152aab5
MD5 6ffdd336f8ebcc19f5c7d279e87dc493
SHA1 263193f0a9c383f8737f7138a54688a85bea02a1
SHA512 1601c3f79a2c1fa3c88cd2f4fb55de1cff6a7778cb47f0aff26a3c6121825c350860f6c7b0a9f0fdb13b727f240bce1eeb7026c9443bffa41c83b0777a368779
SSDEEP 98304:8TSR+WfYMkJCsF27nIUCZ3zb8RkjCVjY6h:uUd0zKxY6h
TLSH
T15AE59D5AE7E901B8C1A3C4B989166417FA7138430B35E6EB56E088565F33BE02F7E770
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects binaries and memory artifacts referencing sandbox product IDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxProductID

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_6ffdd336f8ebcc19f5c7d279e87dc493_glassworm_icedid_luca-stealer_njrat

File Explorer

2026-08-19_6ffdd336f8ebcc19f5c7d279e87dc493_glassworm_icedid_luca-stealer_njrat

.exe 3.0MB

2026-08-19_6ffdd336f8ebcc19f5c7d279e87dc493_glassworm_icedid_luca-stealer_njrat

IMPHASH 49839035e7b4244fbfbb6aa39541bf40
SHA256 bdd8ed23e881143cb0e6dbba8beb4032a8e82762bf27e9c1739cfed0a152aab5
MD5 6ffdd336f8ebcc19f5c7d279e87dc493
SHA1 263193f0a9c383f8737f7138a54688a85bea02a1
SHA512 1601c3f79a2c1fa3c88cd2f4fb55de1cff6a7778cb47f0aff26a3c6121825c350860f6c7b0a9f0fdb13b727f240bce1eeb7026c9443bffa41c83b0777a368779
SSDEEP 98304:8TSR+WfYMkJCsF27nIUCZ3zb8RkjCVjY6h:uUd0zKxY6h
TLSH
T15AE59D5AE7E901B8C1A3C4B989166417FA7138430B35E6EB56E088565F33BE02F7E770
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects binaries and memory artifacts referencing sandbox product IDs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1941144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpReadData WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpWebSocketCompleteUpgrade WinHttpWebSocketClose WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpQueryDataAvailable WinHttpQueryHeaders

crypt32

CryptBinaryToStringA CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptDestroyHash BCryptEncrypt BCryptSetProperty BCryptHashData BCryptGenerateSymmetricKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCreateHash BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptFinishHash

shell32

ShellExecuteExW

shlwapi

PathFindFileNameW

ole32

CoTaskMemFree CreateStreamOnHGlobal

ntdll

RtlPcToFileHeader RtlInitUnicodeString RtlUnwind RtlUnwindEx

gdiplus

GdipGetImageGraphicsContext GdipDeleteGraphics GdipCreateBitmapFromScan0 GdiplusStartup GdiplusShutdown GdipGetImageEncoders GdipSetInterpolationMode GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipDrawImageRectI GdipCloneImage GdipSetCompositingQuality GdipSetPixelOffsetMode

kernel32

GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread TlsFree TlsSetValue TlsGetValue GetLastError GetProcAddress ExitProcess GetModuleHandleW SetThreadAffinityMask GetSystemFirmwareTable GetPhysicallyInstalledSystemMemory LocalAlloc GetModuleHandleA CreateToolhelp32Snapshot Process32NextW QueryPerformanceFrequency Process32FirstW CloseHandle GetNativeSystemInfo LocalFree WideCharToMultiByte SleepEx BuildCommDCBAndTimeoutsA EnumSystemFirmwareTables QueryPerformanceCounter VirtualQuery GetComputerNameA SizeofResource WriteFile GetModuleFileNameW EnumResourceNamesW GetTempPathW WaitForSingleObject CreateFileW SetFileAttributesW GetLogicalDriveStringsW EndUpdateResourceW LockResource DeleteFileW LoadResource FindResourceW UpdateResourceW FreeLibrary BeginUpdateResourceW QueryFullProcessImageNameW GetTempFileNameW GetDriveTypeW LoadLibraryExW GetVolumeInformationW GetComputerNameW GlobalMemoryStatusEx GlobalAlloc GlobalFree GlobalLock GetConsoleMode FindFirstFileW FindNextFileW FindClose GetFileAttributesExW GetCurrentThreadId GetSystemTime CreateMutexA ExitThread GetTickCount64 CreateEventA SetUnhandledExceptionFilter GetTimeZoneInformation GetSystemInfo GetLocalTime CreateDirectoryW ReadFile QueryDosDeviceW GetFileSizeEx GetLongPathNameW GetCurrentProcess GetEnvironmentVariableW GetFileAttributesW MultiByteToWideChar TerminateThread CreateThread MoveFileExW GetCurrentProcessId LoadLibraryW SetDllDirectoryW OpenEventA GetLogicalDrives GetDriveTypeA CreatePipe SetErrorMode SetEvent FileTimeToSystemTime SetFilePointerEx CreateProcessA GetDiskFreeSpaceExA GetTickCount AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW GetVersionExW UnmapViewOfFile HeapValidate HeapSize Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA HeapReAlloc RaiseException HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetFileSize DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile FlushFileBuffers CreateProcessW CreateNamedPipeW ReadConsoleW ConnectNamedPipe IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError GlobalUnlock PeekNamedPipe

user32

GetDC EnumDisplayDevicesW GetSystemMetrics SetClipboardData ReleaseDC GetClipboardData QueryDisplayConfig EmptyClipboard CloseClipboard OpenClipboard SendInput GetMonitorInfoW EnumDisplayMonitors

gdi32

SelectObject BitBlt CreateCompatibleBitmap GetDeviceCaps DeleteObject DeleteDC CreateCompatibleDC

advapi32

OpenProcessToken RegEnumKeyExW RegQueryValueExA RegCloseKey RegOpenKeyExW RegGetValueW GetTokenInformation CryptDestroyHash CryptAcquireContextA RegCreateKeyExW RegSetValueExW SetSecurityDescriptorDacl InitializeSecurityDescriptor GetUserNameW RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges CryptAcquireContextW CryptGetHashParam CryptReleaseContext CryptCreateHash CryptGenRandom CryptHashData

setupapi

SetupDiDestroyDeviceInfoList SetupDiOpenDevRegKey SetupDiGetDeviceRegistryPropertyA SetupDiGetDeviceRegistryPropertyW SetupDiGetDevicePropertyW SetupDiEnumDeviceInfo SetupDiGetClassDevsW

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime

iphlpapi

GetAdaptersInfo

api-ms-win-core-processthreads-l1-1-0

GetExitCodeThread TerminateProcess GetStartupInfoW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive TryAcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-0

InitOnceComplete SleepConditionVariableSRW WakeAllConditionVariable InitOnceBeginInitialize WakeConditionVariable

api-ms-win-core-file-l1-1-0

FindFirstFileExW GetFinalPathNameByHandleW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-localization-l1-2-0

LCMapStringEx GetLocaleInfoEx GetCPInfo

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-string-l1-1-0

CompareStringEx GetStringTypeW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

wevtapi

EvtQuery EvtRender EvtClose EvtCreateRenderContext EvtNext

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

mf

MFEnumDeviceSources

mfplat

MFShutdown MFCreateMediaType MFCreateAttributes MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

738KB

Virtual Size

738KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_6ffdd336f8ebcc19f5c7d279e87dc493_glassworm_icedid_luca-stealer_njrat

winhttp

crypt32

bcrypt

shell32

shlwapi

ole32

ntdll

gdiplus

kernel32

user32

gdi32

advapi32

setupapi

api-ms-win-core-realtime-l1-1-1

iphlpapi

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

wevtapi

d3d11

dxgi

mf

mfplat

mfreadwrite

generic