2026-08-28_07f13be743a2fa06ccabd1fa09108231_amadey_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-28_07f13be743a2fa06ccabd1fa09108231_amadey_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
Size 21.2MB
Sample260828-2vb36atgmd
SHA256 870c27d831bb445b593667f7a8c9b8e978c1b2678b3eed30dcd80c96069f123e
MD5 07f13be743a2fa06ccabd1fa09108231
SHA1 1259c2332ba9457dff3dc0d4f22366d326c3d40b
SHA512 c4b18b839148d0c9177426e0c4a96ca291c00ebfdc43a35291a54cfe1915339506c25f957d31362e53ff2c3703e7dc1bf18fb10df7aba021d38d0fcba5773ae7
SSDEEP 196608:y1tIDewjqkjN1tIDewjqkjN1tIDewjqkjCFIF0wuQ:y8KwekB8KwekB8KwekAQ
TLSH
T16B277D399AF441E4F9BBD87CA96BC632EA713A110133534BCAE0C617AF336525D29731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-28_07f13be743a2fa06ccabd1fa09108231_amadey_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar

File Explorer

2026-08-28_07f13be743a2fa06ccabd1fa09108231_amadey_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar

.exe 21.2MB

2026-08-28_07f13be743a2fa06ccabd1fa09108231_amadey_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar

IMPHASH 91b6dee46d1e9cb862048488e244bc70
SHA256 870c27d831bb445b593667f7a8c9b8e978c1b2678b3eed30dcd80c96069f123e
MD5 07f13be743a2fa06ccabd1fa09108231
SHA1 1259c2332ba9457dff3dc0d4f22366d326c3d40b
SHA512 c4b18b839148d0c9177426e0c4a96ca291c00ebfdc43a35291a54cfe1915339506c25f957d31362e53ff2c3703e7dc1bf18fb10df7aba021d38d0fcba5773ae7
SSDEEP 196608:y1tIDewjqkjN1tIDewjqkjN1tIDewjqkjCFIF0wuQ:y8KwekB8KwekB8KwekAQ
TLSH
T16B277D399AF441E4F9BBD87CA96BC632EA713A110133534BCAE0C617AF336525D29731
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3818544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\dbs\el\dec\target\x64\ship\click2run\x-none\Integrator.pdb

advapi32

RegCreateKeyExW RegCloseKey RegOpenKeyExW RegSetValueExW RegQueryValueExW EventWriteTransfer EventRegister EventUnregister RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW RegDeleteTreeW RegDeleteKeyW RegGetValueW RegDeleteValueW GetTokenInformation IsValidSid GetSidSubAuthorityCount GetSidSubAuthority AllocateAndInitializeSid FreeSid EqualSid OpenProcessToken CreateWellKnownSid RevertToSelf OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW OpenSCManagerW CloseServiceHandle OpenServiceW QueryServiceStatusEx QueryServiceConfigW StartServiceW ControlService EnumDependentServicesW ChangeServiceConfigW GetLengthSid CopySid InitializeAcl AddAccessAllowedAce InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertSidToStringSidA CheckTokenMembership RegNotifyChangeKeyValue EventWrite RegGetValueA SetNamedSecurityInfoW GetSecurityDescriptorControl SetEntriesInAclW BuildTrusteeWithSidW GetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorA

kernel32

GetUserDefaultLCID LoadLibraryA LCMapStringW FreeLibrary GetSystemTimeAsFileTime GetCurrentThreadId FlsAlloc TlsAlloc FlsFree TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue GetTickCount64 GetProcAddress GetModuleHandleExW K32GetProcessMemoryInfo GlobalMemoryStatusEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection ReleaseSRWLockShared AcquireSRWLockShared ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeSRWLock GetCurrentProcessId FileTimeToSystemTime GetUserDefaultLocaleName IsValidCodePage SetLastError WideCharToMultiByte GetSystemTime SystemTimeToFileTime GetCPInfoExW CreateEventExW GetStringTypeW RaiseException LoadLibraryExW GetModuleHandleW VerSetConditionMask VerifyVersionInfoW GetVersionExW GetProcessTimes TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW FindResourceW SizeofResource LoadResource OpenProcess GetDiskFreeSpaceExW CreateFileW DeviceIoControl SetErrorMode GetComputerNameW FormatMessageW FormatMessageA LocalFree GetLogicalProcessorInformation GetNativeSystemInfo GetSystemDirectoryW CreateActCtxW ActivateActCtx HeapFree OutputDebugStringA FindActCtxSectionStringW DeactivateActCtx QueryActCtxW LoadLibraryW HeapAlloc GetProcessHeap ReleaseMutex OpenMutexW WaitForSingleObjectEx lstrlenW GetPriorityClass GetExitCodeProcess ProcessIdToSessionId GetCurrentThread GetExitCodeThread WaitForMultipleObjects WaitForMultipleObjectsEx SignalObjectAndWait GetProcessAffinityMask GetLogicalProcessorInformationEx CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer QueryDepthSList TryEnterCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace MapViewOfFile ReadFile SetFilePointerEx GetFileSizeEx GetTempPathW GetTempFileNameW GetTickCount SetEvent CreateDirectoryW FindNextFileW FindFirstFileW lstrcmpW RemoveDirectoryW CopyFileW GetFileAttributesW CreateFileMappingW FlushViewOfFile GetFileType SetEndOfFile SetFilePointer GetOverlappedResult UnlockFile LockFile SetFileInformationByHandle GetFileInformationByHandleEx GetLongPathNameW GetFullPathNameW CreateMutexW ReleaseSemaphore OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA GlobalFree LocalAlloc DeleteFileA GetTempPathA GetCommandLineW SetEnvironmentVariableW GetTimeZoneInformation IsValidLocale CreateEventW WaitForSingleObject CreateThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork ResetEvent QueryPerformanceCounter QueryPerformanceFrequency VirtualProtectEx GetSystemInfo LockResource FlushFileBuffers CancelIoEx WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW IsProcessorFeaturePresent CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetQueuedCompletionStatus IsDebuggerPresent GetStartupInfoW CreateMemoryResourceNotification GetSystemPowerStatus IsSystemResumeAutomatic QueryUnbiasedInterruptTime OutputDebugStringW RtlCaptureContext GetModuleHandleA VirtualFree VirtualAlloc LCMapStringEx LCIDToLocaleName LocaleNameToLCID GetPhysicallyInstalledSystemMemory GetProductInfo SwitchToThread DecodePointer AreFileApisANSI HeapCreate GetDiskFreeSpaceW InitializeCriticalSection GetFullPathNameA UnlockFileEx HeapValidate HeapSize GetDiskFreeSpaceA GetFileAttributesA HeapReAlloc HeapCompact HeapDestroy LockFileEx GetSystemDefaultLCID GetLocalTime LoadLibraryExA VirtualQuery WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP SetStdHandle EnumSystemLocalesW GetTimeFormatW GetDateFormatW GetCommandLineA ExitProcess GetStdHandle ExitThread GetConsoleCP ReadConsoleW GetConsoleMode UnregisterWaitEx VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetThreadPriority SetThreadPriority CreateTimerQueue InterlockedFlushSList RtlUnwindEx SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetLocaleInfoW CompareStringW GetCPInfo InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader DuplicateHandle DeleteTimerQueueTimer GetFileSize CreateFileMappingA CloseHandle CreateFileA UnmapViewOfFile CreateTimerQueueTimer GetUserGeoID FindFirstFileExW FindClose SetFileAttributesW DeleteFileW GetModuleFileNameW MultiByteToWideChar GetStringTypeExW GetFileAttributesExW ExpandEnvironmentStringsW IsWow64Process CompareStringEx GetLastError GlobalAlloc Sleep GetCurrentProcess WriteFile RtlUnwind

ole32

IIDFromString CoCreateInstance CoSetProxyBlanket CoTaskMemFree CLSIDFromString StringFromGUID2 CoCreateGuid CoCreateFreeThreadedMarshaler CoInitializeEx CoTaskMemAlloc CreateStreamOnHGlobal CoRevokeInitializeSpy CoInitialize CoUninitialize CoRegisterInitializeSpy

oleaut32

VariantInit SysAllocString SysFreeString VariantClear

wintrust

WintrustAddActionID WintrustRemoveActionID

iphlpapi

GetAdaptersInfo

gdi32

GetDeviceCaps

winspool.drv

AddPrinterW DeletePrinter XcvDataW OpenPrinterW DeletePrinterDriverExW ClosePrinter InstallPrinterDriverFromPackageW UploadPrinterDriverPackageW

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

162KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

177KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-28_07f13be743a2fa06ccabd1fa09108231_amadey_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar

advapi32

kernel32

ole32

oleaut32

wintrust

iphlpapi

gdi32

winspool.drv

generic