2026-08-27_eb1f6070268134aa9f9dc465b91507b0_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_eb1f6070268134aa9f9dc465b91507b0_glassworm_icedid_luca-stealer_njrat_stealc
Size 8.1MB
Sample260827-gndcesdn5x
SHA256 c5c20737cab116cb5f40a124cbe48eee03e1cc83fc3cda13dfcc0bfad3aa796c
MD5 eb1f6070268134aa9f9dc465b91507b0
SHA1 6c830c1268645ff5cf2c25c5aff38e88416880e3
SHA512 1b623e0a302006a05e6ba0f05e499add9f788e4940c630466eb6ab2aca367880c15c72546149ec8871d6f3fba81afd65d7c620f24f6f190c95a6b924c568d38b
SSDEEP 98304:JlUY9NU+MA4yMf3ARyLiuJFy/zupf7qjFxiSKXHOCO:JlUYwA4nfARyLi2qzuUiROCO
TLSH
T15D86AE5373E941ECE0BBD2798A568922D7737C594332ABDF0290953A5F23AD01E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-27_eb1f6070268134aa9f9dc465b91507b0_glassworm_icedid_luca-stealer_njrat_stealc

.exe 8.1MB

2026-08-27_eb1f6070268134aa9f9dc465b91507b0_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH c4f487b8c967d54f776911e0aaf12d5d
SHA256 c5c20737cab116cb5f40a124cbe48eee03e1cc83fc3cda13dfcc0bfad3aa796c
MD5 eb1f6070268134aa9f9dc465b91507b0
SHA1 6c830c1268645ff5cf2c25c5aff38e88416880e3
SHA512 1b623e0a302006a05e6ba0f05e499add9f788e4940c630466eb6ab2aca367880c15c72546149ec8871d6f3fba81afd65d7c620f24f6f190c95a6b924c568d38b
SSDEEP 98304:JlUY9NU+MA4yMf3ARyLiuJFy/zupf7qjFxiSKXHOCO:JlUYwA4nfARyLi2qzuUiROCO
TLSH
T15D86AE5373E941ECE0BBD2798A568922D7737C594332ABDF0290953A5F23AD01E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

d3:47:fb:ee:19:f4:94:87:82:26:a0:65:84:4c:91:80:e0:f0:cf:be:c3:50:e0:31:f8:ee:93:18:43:08:b8:12

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=NOTEPAD\+\+,O=NOTEPAD\+\+,L=Paris,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d646f6e2e6840667265652e6672

Chains

Aug 23, 2026

CN=NOTEPAD\+\+,O=NOTEPAD\+\+,L=Paris,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d646f6e2e6840667265652e6672

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=NOTEPAD\+\+,O=NOTEPAD\+\+,L=Paris,ST=Île-de-France,C=FR,1.2.840.113549.1.9.1=#0c0d646f6e2e6840667265652e6672

Serial Number

05:f0:d8:13:d6:a6:f0:04:57:5a:20:99

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 9, 2025 - Oct 9, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

4162480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

ImageList_EndDrag ImageList_DragShowNolock ImageList_DragEnter ImageList_DragMove ImageList_BeginDrag ImageList_Remove ord17 ImageList_SetIconSize ImageList_AddMasked InitCommonControlsEx ImageList_GetIcon ImageList_Destroy ImageList_Create ImageList_ReplaceIcon _TrackMouseEvent ord381 ImageList_GetIconSize ord411 ImageList_Draw ord345 ord412 ord410 ImageList_GetImageInfo ord413

shlwapi

PathIsRelativeW PathCombineW PathGetDriveNumberW PathRemoveExtensionW PathCanonicalizeW PathAppendW PathMatchSpecW PathFindExtensionW PathIsNetworkPathW PathCompactPathExW PathRemoveFileSpecW ColorHLSToRGB ColorRGBToHLS PathFindFileNameW PathStripPathW AssocQueryStringW ColorAdjustLuma

shell32

DragQueryFileW SHCreateItemFromParsingName ShellExecuteExW SHParseDisplayName SHOpenFolderAndSelectItems SHFileOperationW DragFinish Shell_NotifyIconW SHGetFolderPathW ord165 ShellExecuteW DragQueryPoint

dbghelp

ImageNtHeader

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

crypt32

CertCloseStore CertGetCertificateContextProperty CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CryptMsgClose CertNameToStrW

wintrust

WinVerifyTrust

sensapi

IsNetworkAlive IsDestinationReachableW

wininet

InternetCrackUrlW

imm32

ImmGetContext ImmGetCompositionStringW ImmNotifyIME ImmSetCandidateWindow ImmSetCompositionStringW ImmEscapeW ImmSetCompositionWindow ImmSetCompositionFontW ImmReleaseContext

msimg32

AlphaBlend

uxtheme

GetThemeColor OpenThemeData CloseThemeData GetThemeFont GetThemeBackgroundContentRect EndBufferedAnimation SetWindowTheme GetThemeTransitionDuration DrawThemeParentBackground GetThemePartSize DrawThemeBackground BufferedPaintRenderAnimation BeginBufferedAnimation EnableThemeDialogTexture DrawThemeTextEx BufferedPaintStopAllAnimations

dwmapi

DwmSetWindowAttribute DwmGetColorizationColor

kernel32

GetDateFormatW GlobalLock GlobalUnlock WriteFile ExpandEnvironmentStringsW GetTimeFormatEx GetProductInfo WaitForSingleObject CreateFileW GetDateFormatEx GetFileAttributesW GetVersionExW FormatMessageW GetTickCount64 GetDiskFreeSpaceExW TerminateThread GlobalAlloc GlobalFree CloseHandle CreateThread GetLocalTime GetCurrentDirectoryW SetFilePointerEx lstrcmpiW FlushFileBuffers GetExitCodeProcess GetFinalPathNameByHandleW SetFileTime FindFirstStreamW lstrcpynW SetCurrentDirectoryW SizeofResource LockResource LoadResource FindResourceW CreateEventW SetEvent ResetEvent CopyFileW GetCurrentProcess GetLocaleInfoEx CreateMutexW ReleaseMutex Sleep OpenProcess GetApplicationRestartSettings UnregisterApplicationRestart lstrcmpiA QueryFullProcessImageNameW RegisterApplicationRestart GlobalSize WaitForMultipleObjects CopyFileExW CompareStringOrdinal GetACP GetSystemInfo UnmapViewOfFile CreateFileMappingW MapViewOfFile lstrcpynA FileTimeToLocalFileTime CancelIo WaitForSingleObjectEx QueueUserAPC SleepEx ReadDirectoryChangesW GetLocaleInfoA LCMapStringW GetTickCount GetStringTypeExW LCMapStringA GetStringTypeExA GetUserDefaultLCID LoadLibraryA DecodePointer EncodePointer SystemTimeToTzSpecificLocalTime InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetNativeSystemInfo SleepConditionVariableSRW WakeAllConditionVariable GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RaiseException RtlPcToFileHeader InitOnceBeginInitialize InitOnceComplete QueryPerformanceFrequency QueryPerformanceCounter GetFileInformationByHandleEx AreFileApisANSI FindFirstFileExW GetStringTypeW FormatMessageA TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive lstrcpyW ReplaceFileW MoveFileExW GetTimeFormatW DeleteFileW FileTimeToSystemTime GetLongPathNameW GetFullPathNameW SetLastError CompareFileTime CreateDirectoryW lstrlenW FindClose FindNextFileW FindFirstFileW WideCharToMultiByte GetVersion GetModuleFileNameW MulDiv lstrcmpW GetCurrentThreadId LocalFree GetLastError LocalAlloc LCMapStringEx MultiByteToWideChar LoadLibraryExW FreeLibrary GetModuleHandleW GetProcAddress VirtualProtect GetFileAttributesExW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx GetSystemTimeAsFileTime SetFileAttributesW DeleteCriticalSection GetTempPathW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ReadFile ExitProcess GetCommandLineA GetCommandLineW ExitThread FreeLibraryAndExitThread GetStdHandle HeapAlloc HeapFree GetFileType GetConsoleMode ReadConsoleW FlsAlloc RtlUnwind FlsGetValue FlsSetValue FlsFree CompareStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation GetFileSizeEx GetConsoleOutputCP IsValidCodePage GetOEMCP HeapReAlloc GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize SetEndOfFile WriteConsoleW GetCurrentProcessId

user32

MonitorFromRect CreateDialogParamW SetRectEmpty GetCapture LoadBitmapW ScrollWindow RemovePropW GetPropW InsertMenuItemW GetCaretBlinkTime AppendMenuA GetMessageTime ValidateRect DestroyCursor MsgWaitForMultipleObjects NotifyWinEvent GetUpdateRgn SystemParametersInfoA GetDoubleClickTime MonitorFromPoint AdjustWindowRectEx LoadStringW LoadStringA CallWindowProcW DialogBoxIndirectParamW mouse_event GetDlgItemTextA SetScrollInfo GetScrollInfo GetMessageW DeferWindowPos GetWindow UnregisterClassW RegisterClassExW TrackPopupMenu BeginDeferWindowPos DispatchMessageW PeekMessageW MessageBoxA TranslateMessage LoadIconW EndDeferWindowPos FlashWindowEx PostQuitMessage GetDlgItemInt BringWindowToTop SetCapture ReleaseCapture GetActiveWindow IsChild GetSysColorBrush GetKeyState CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetMenuState GetMenuItemCount CreatePopupMenu SetMenuItemInfoW DestroyMenu InsertMenuW TrackPopupMenuEx CheckMenuItem EnableMenuItem CreateMenu GetWindowTextLengthW EnumDisplayMonitors IsWindow EmptyClipboard SetClipboardData FindWindowExW SetTimer KillTimer SetDlgItemInt IsWindowVisible ShowWindow ClientToScreen RegisterClipboardFormatW SetClipboardViewer OpenClipboard ChangeClipboardChain CloseClipboard GetClipboardData IsClipboardFormatAvailable CreateDialogIndirectParamW ShowScrollBar PostMessageW GetMenu DestroyWindow HideCaret CreateWindowExW MessageBeep GetScrollPos GetWindowPlacement GetKeyboardState SetCaretPos GetScrollRange CreateCaret RegisterClassW SetWindowPlacement DrawTextExW LoadCursorW DestroyCaret SetCursor SetScrollRange ShowCaret SetScrollPos DrawEdge UpdateWindow DrawFrameControl ToAscii MoveWindow EndDialog DestroyIcon SetFocus DrawIconEx EnableWindow GetDC LoadImageW GetMenuItemInfoW DefWindowProcW GetWindowRect DialogBoxParamW ShowCursor MapVirtualKeyW GetKeyboardLayout CreateAcceleratorTableW IsCharLowerW CharUpperW CharLowerW IsCharAlphaNumericW IsCharAlphaW FindWindowW GetWindowThreadProcessId GetLastActivePopup LoadMenuW GetClassNameA GetWindowTextA RemoveClipboardFormatListener AddClipboardFormatListener RegisterWindowMessageW IsDialogMessageW SetMenu LockWindowUpdate GetDCEx CheckMenuRadioItem GetFocus InflateRect SetWindowPos EqualRect MessageBoxW EnumChildWindows SetWindowLongPtrW ScreenToClient GetSystemMetrics GetWindowLongPtrW GetMenuBarInfo OffsetRect RedrawWindow MapWindowPoints TrackMouseEvent FrameRect DrawFocusRect GetSysColor IsWindowEnabled IntersectRect GetClassNameW GetWindowDC EnumThreadWindows GetComboBoxInfo GetClientRect DrawTextW GetParent PtInRect SetForegroundWindow InvalidateRect ReleaseDC GetCursorPos BeginPaint EndPaint GetWindowTextW SetWindowTextW GetDlgCtrlID SetDlgItemTextW GetDlgItemTextW SendDlgItemMessageW SetDlgItemTextA GetDlgItem wsprintfW SendMessageW FillRect SetPropW SystemParametersInfoW GetAncestor WindowFromPoint MonitorFromWindow DeleteMenu SetMenuItemBitmaps ChildWindowFromPointEx GetMonitorInfoW DestroyAcceleratorTable TranslateAcceleratorW DrawMenuBar IsZoomed AppendMenuW IsIconic ModifyMenuW GetMenuItemID GetSubMenu GetMenuStringW RemoveMenu CreateIconIndirect GetIconInfo GetWindowLongW SetLayeredWindowAttributes SetParent

gdi32

SetWindowOrgEx OffsetWindowOrgEx GetPixel LineTo MoveToEx CreateFontW CreateBitmap CreatePatternBrush PatBlt SetBrushOrgEx SetStretchBltMode SetDIBits GetDIBits StretchDIBits CreateDIBSection EnumFontFamiliesExW EndPage DPtoLP StartDocW ExtTextOutW SetTextAlign EndDoc StartPage RectVisible GetTextExtentPointW CreateHatchBrush Polygon ExtCreatePen StretchBlt Ellipse GetTextExtentExPointA GdiAlphaBlend GetTextExtentExPointW GetTextExtentPoint32A ExtTextOutA GetTextMetricsW Rectangle SetROP2 GetDeviceCaps GetObjectW BitBlt CreateCompatibleBitmap SaveDC SelectObject CreateCompatibleDC GetClipRgn GetStockObject CreateRectRgnIndirect Polyline CreateRectRgn DeleteDC GetTextExtentPoint32W SetTextColor SetBkMode CreatePen SelectClipRgn ExcludeClipRect SetBkColor RestoreDC CreateFontIndirectW RoundRect IntersectClipRect DeleteObject CombineRgn GetROP2 CreateSolidBrush

comdlg32

PrintDlgW ChooseColorW

advapi32

RegDeleteKeyW CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegGetValueW RegQueryValueExW RegOpenKeyExW RegQueryInfoKeyW RegCloseKey CheckTokenMembership FreeSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken GetSidSubAuthority GetSidSubAuthorityCount RegOpenKeyExA RegQueryValueExA RegDeleteValueW RegSetValueExW RegEnumKeyExW RegCreateKeyExW IsTextUnicode CryptReleaseContext

ole32

RegisterDragDrop OleInitialize RevokeDragDrop CLSIDFromProgID OleUninitialize ReleaseStgMedium CoInitialize CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize DoDragDrop

oleaut32

SysAllocStringLen SysFreeString

bcrypt

BCryptGetProperty BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptDestroyHash

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

73KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_eb1f6070268134aa9f9dc465b91507b0_glassworm_icedid_luca-stealer_njrat_stealc

comctl32

shlwapi

shell32

dbghelp

version

crypt32

wintrust

sensapi

wininet

imm32

msimg32

uxtheme

dwmapi

kernel32

user32

gdi32

comdlg32

advapi32

ole32

oleaut32

bcrypt

generic