2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 14.6MB
Sample260905-nl78catclf
SHA256 d33829615820c3087338a48a8f4d10875a9bd024e279a4ff9519cbd1b7891e0f
MD5 4c8f75599fce103a1b7a1f4e2e79a7fd
SHA1 041dc64ccfedb366f54142099ee2a62201f12121
SHA512 87b4327088c557fafdbd7586c16b5d12422fd7bb6c6113d38d0c3cc82297d95e4c458127949771d7d3c52c8317df4386f0ce3042d89f78448741de39ec33ec1a
SSDEEP 98304:VUWc6ndSKCm7GHOp09KXTqU6Zb9JxpWsLsZBbChgHohog/pzjyUnu:VUW/RCjH00UXTv6VnLsPChgISYz
TLSH
T1EDF6AD62ABAD469DE06EB038C5875217E7F17C0C0360DFDB55D08D675E3BAD0BA3A218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar

.exe 14.6MB

2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 3a5348a2a6847cb528be12a65926eaa6
SHA256 d33829615820c3087338a48a8f4d10875a9bd024e279a4ff9519cbd1b7891e0f
MD5 4c8f75599fce103a1b7a1f4e2e79a7fd
SHA1 041dc64ccfedb366f54142099ee2a62201f12121
SHA512 87b4327088c557fafdbd7586c16b5d12422fd7bb6c6113d38d0c3cc82297d95e4c458127949771d7d3c52c8317df4386f0ce3042d89f78448741de39ec33ec1a
SSDEEP 98304:VUWc6ndSKCm7GHOp09KXTqU6Zb9JxpWsLsZBbChgHohog/pzjyUnu:VUW/RCjH00UXTv6VnLsPChgISYz
TLSH
T1EDF6AD62ABAD469DE06EB038C5875217E7F17C0C0360DFDB55D08D675E3BAD0BA3A218
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15289856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

SetHandleInformation GetLastError CreatePipe WaitForSingleObject CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId CreateProcessA VirtualProtect ReadProcessMemory MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW lstrcpyA lstrcatA CreateToolhelp32Snapshot Process32FirstW Process32NextW HeapAlloc HeapFree GetProcessHeap LocalFree FlushFileBuffers ReadFile ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW GetTickCount DuplicateHandle CreateMutexA CreateThread TerminateThread OpenProcess GetSystemInfo VirtualQueryEx CreateFileMappingA GetSystemTimeAsFileTime WinExec GetVolumeInformationA Beep GetFileSizeEx HeapReAlloc SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage CloseHandle GetTimeZoneInformation SetFilePointerEx ReadConsoleW CreateFileA GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc OutputDebugStringW GetCommandLineW GetCommandLineA FreeLibraryAndExitThread ExitThread ExitProcess WriteConsoleW GetModuleHandleExW GetModuleFileNameW GetFileType GetStdHandle LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetLastError RtlPcToFileHeader RtlUnwindEx GetStringTypeW GetCPInfo GetTempPathA WriteFile GetFileAttributesA FindNextFileW CreateDirectoryA GetEnvironmentVariableW GetEnvironmentVariableA IsDBCSLeadByte GetLocaleInfoA LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter VerSetConditionMask WideCharToMultiByte MultiByteToWideChar SetEndOfFile GlobalFree GlobalLock CompareStringEx LCMapStringEx DecodePointer EncodePointer FindFirstFileW FindClose DeleteFileA FindFirstFileExW CreateFileW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionEx TryAcquireSRWLockExclusive GlobalUnlock GlobalAlloc OutputDebugStringA HeapSize GetConsoleMode InitializeSListHead GetCurrentThreadId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive RaiseException VirtualQuery LoadLibraryExA ReleaseSRWLockExclusive

user32

UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetLayeredWindowAttributes SetWindowPos SetFocus UpdateWindow PostQuitMessage OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo DefWindowProcW PostMessageW GetCapture SetCapture ReleaseCapture IsWindowUnicode GetForegroundWindow GetDC ReleaseDC GetClientRect SetCursorPos SetCursor GetCursorPos ClientToScreen ScreenToClient LoadCursorW SetProcessDPIAware GetSystemMetrics GetWindowRect wsprintfW TranslateMessage DispatchMessageW GetKeyState SetWindowLongPtrW SetActiveWindow GetAsyncKeyState MonitorFromPoint FindWindowW SetForegroundWindow GetWindowLongPtrW MessageBoxA PeekMessageW

gdi32

GetDeviceCaps

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextW OpenProcessToken

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

winmm

PlaySoundA

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

bcrypt

BCryptDestroyHash BCryptEncrypt BCryptHashData BCryptCreateHash BCryptFinalizeKeyPair BCryptFinishHash BCryptGenRandom BCryptCloseAlgorithmProvider BCryptExportKey BCryptGenerateKeyPair BCryptDestroyKey BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptGetProperty BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt

crypt32

CryptImportPublicKeyInfoEx2 CryptBinaryToStringA CryptStringToBinaryA CryptDecodeObjectEx

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

Name

.text

Size

6.8MB

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

498KB

Virtual Size

497KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.1337

Size

512B

Virtual Size

61B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2.5MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar

d3d11

kernel32

user32

gdi32

advapi32

shell32

ole32

imm32

dwmapi

winmm

ntdll

bcrypt

crypt32

winhttp

generic