2026-09-04_3ed4bb8def42bc66a8cdadab6bb749cf_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_3ed4bb8def42bc66a8cdadab6bb749cf_glassworm_icedid_luca-stealer_njrat_stealc
Size 9.7MB
Sample260905-qlacescr5z
SHA256 bd0927639d6cdcbbfced059e68beabda2670b40ee4eb103af1dc9a7409482d3b
MD5 3ed4bb8def42bc66a8cdadab6bb749cf
SHA1 529ea9cd2423c784b373074abce290c7891f6350
SHA512 855a363864c77fc8ea5e68852701c14a65294bda77948b182c442389e180d40f535b4f55a955d959173fabec7840b4e8ae462dcad70734b416dd02fb4dfbdac5
SSDEEP 98304:l0pI/wkIzFZfvJdPxPozyCNqVEHJIcS3cK4ECXE5VDjdBJO+v7/1k+OLpZCY+WUE:l0pIYvx1Pk1/2jRX
TLSH
T15CA68D16B7A800B8D1B7C17DCA574A07E7B278450760ABDF07E056AA6F73BE01A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_3ed4bb8def42bc66a8cdadab6bb749cf_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-04_3ed4bb8def42bc66a8cdadab6bb749cf_glassworm_icedid_luca-stealer_njrat_stealc

.exe 9.7MB

2026-09-04_3ed4bb8def42bc66a8cdadab6bb749cf_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH e2edef15c9c3d8cd6d4ec607e25ccd73
SHA256 bd0927639d6cdcbbfced059e68beabda2670b40ee4eb103af1dc9a7409482d3b
MD5 3ed4bb8def42bc66a8cdadab6bb749cf
SHA1 529ea9cd2423c784b373074abce290c7891f6350
SHA512 855a363864c77fc8ea5e68852701c14a65294bda77948b182c442389e180d40f535b4f55a955d959173fabec7840b4e8ae462dcad70734b416dd02fb4dfbdac5
SSDEEP 98304:l0pI/wkIzFZfvJdPxPozyCNqVEHJIcS3cK4ECXE5VDjdBJO+v7/1k+OLpZCY+WUE:l0pIYvx1Pk1/2jRX
TLSH
T15CA68D16B7A800B8D1B7C17DCA574A07E7B278450760ABDF07E056AA6F73BE01A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

380344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpAddRequestHeaders WinHttpWebSocketClose WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpWebSocketCompleteUpgrade WinHttpGetIEProxyConfigForCurrentUser WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen

wininet

HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile

bcrypt

BCryptCloseAlgorithmProvider BCryptGetProperty BCryptEncrypt BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptSetProperty BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptOpenAlgorithmProvider

crypt32

CryptBinaryToStringA CryptStringToBinaryA

ws2_32

htonl closesocket ntohs recv setsockopt shutdown socket bind accept getsockname listen send

advapi32

RegQueryValueExA RegOpenKeyExA RegCreateKeyExW RegCloseKey GetUserNameA RegSetValueExW

shlwapi

PathRemoveFileSpecW PathFindFileNameW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

VariantInit SysAllocString SysFreeString

kernel32

WakeAllConditionVariable WriteConsoleW CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapQueryInformation HeapSize HeapReAlloc GetTimeZoneInformation SetFilePointerEx EncodePointer DecodePointer LCMapStringEx GetCommandLineW GetStringTypeW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect GetCPInfo InitializeSListHead GetCurrentProcessId IsDebuggerPresent UnhandledExceptionFilter FlsFree FlsSetValue FlsGetValue ReadFile WriteFile CloseHandle SetHandleInformation GetLastError CreatePipe PeekNamedPipe WaitForSingleObject CreateMutexW Sleep CreateProcessA GetSystemTimeAsFileTime GetLocalTime GetTickCount GetComputerNameExA GetProductInfo FreeLibrary GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryA GlobalFree GetComputerNameA FileTimeToSystemTime SystemTimeToFileTime RegisterApplicationRestart MultiByteToWideChar WideCharToMultiByte FindClose EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetSystemInfo GetModuleHandleW GetCurrentProcess SetLastError DebugBreak ExitProcess VirtualAlloc VirtualFree RtlCompareMemory QueryPerformanceCounter QueryPerformanceFrequency DeleteCriticalSection FlsAlloc InitializeCriticalSectionEx GetFileType HeapFree HeapAlloc GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlUnwindEx RaiseException RtlPcToFileHeader TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW SetUnhandledExceptionFilter

user32

TranslateMessage DispatchMessageA DefWindowProcA GetMessageA RegisterClassA CreateWindowExA

ntdll

RtlImageDirectoryEntryToData RtlHashUnicodeString RtlNtStatusToDosError RtlExitUserThread NtQuerySystemTime LdrUnloadDll NtQueryVirtualMemory RtlFreeHeap NtProtectVirtualMemory RtlGetNtVersionNumbers RtlImageNtHeader NtClose NtUnmapViewOfSection NtMapViewOfSection NtOpenSection RtlAllocateHeap LdrLockLoaderLock LdrUnlockLoaderLock RtlUpcaseUnicodeChar RtlRaiseStatus RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtCreateSection

Name

.text

Size

590KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.1MB

Virtual Size

9.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

13KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_3ed4bb8def42bc66a8cdadab6bb749cf_glassworm_icedid_luca-stealer_njrat_stealc

winhttp

wininet

bcrypt

crypt32

ws2_32

advapi32

shlwapi

ole32

oleaut32

kernel32

user32

ntdll

generic