2026-09-16_98c5ff54a5018af95075d92c025f6587_glassworm_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_98c5ff54a5018af95075d92c025f6587_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 5.7MB
Sample260916-mkfahaal2s
SHA256 151bfd44d8368e9c4325cc658188f5ca87aca18cec7589dad4053166fe0d02a0
MD5 98c5ff54a5018af95075d92c025f6587
SHA1 2100b7ad05963fe4d42e6dfab0d226fe9a97b158
SHA512 2e09172d62632016ccfa3a7618240f28aac35dba63f3251eab6349c1e49e3734afc6fc7267bb55579b8ee352578c70894b7563eb1dc9acb6623b8df12c54902e
SSDEEP 49152:vTjwCCgIJeiEb2tiP5mbtvbFClRGvMsidtLkoY2KLc2Mt1E3TQptx:vICCPEWxvmRGYAQtGC3
TLSH
T12D56E85AD6B642E1D4F9D178C626722BFC713C5EC134A70BA781AB175B32760EA3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_98c5ff54a5018af95075d92c025f6587_glassworm_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-09-16_98c5ff54a5018af95075d92c025f6587_glassworm_icedid_luca-stealer_njrat_stealc_vidar

.exe 5.7MB

2026-09-16_98c5ff54a5018af95075d92c025f6587_glassworm_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 9f5c573e14389ecdf62410e8f0fb6691
SHA256 151bfd44d8368e9c4325cc658188f5ca87aca18cec7589dad4053166fe0d02a0
MD5 98c5ff54a5018af95075d92c025f6587
SHA1 2100b7ad05963fe4d42e6dfab0d226fe9a97b158
SHA512 2e09172d62632016ccfa3a7618240f28aac35dba63f3251eab6349c1e49e3734afc6fc7267bb55579b8ee352578c70894b7563eb1dc9acb6623b8df12c54902e
SSDEEP 49152:vTjwCCgIJeiEb2tiP5mbtvbFClRGvMsidtLkoY2KLc2Mt1E3TQptx:vICCPEWxvmRGYAQtGC3
TLSH
T12D56E85AD6B642E1D4F9D178C626722BFC713C5EC134A70BA781AB175B32760EA3E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3721688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2047_D20260612T115830\fa_rss\Release\PCAppStore.pdb

urlmon

URLDownloadToFileW CreateUri

ws2_32

WSAGetLastError recv shutdown closesocket socket WSAStartup WSACleanup send WSAConnectByNameW

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpSetOption WinHttpQueryHeaders

wininet

InternetQueryDataAvailable HttpSendRequestW HttpOpenRequestW InternetReadFile InternetOpenUrlW InternetConnectW InternetCloseHandle InternetOpenW HttpQueryInfoW InternetSetOptionW HttpAddRequestHeadersW

secur32

ApplyControlToken InitializeSecurityContextW DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW DeleteSecurityContext EncryptMessage FreeContextBuffer

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

shlwapi

PathFindFileNameW PathCreateFromUrlW PathAddBackslashW UrlCreateFromPathW AssocCreate SHCreateStreamOnFileEx PathRenameExtensionW

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

msi

ord70 ord45 ord32 ord118 ord8 ord160 ord92 ord159

kernel32

InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread RtlUnwind CompareStringEx ExitThread WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle ReadConsoleW SetFilePointerEx GetFileSizeEx IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW WideCharToMultiByte DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesExW GetFullPathNameW GetEnvironmentVariableW LoadResource LockResource SizeofResource FindResourceW SetEnvironmentVariableW SetEvent ResetEvent CreateEventW Sleep WaitForMultipleObjects GetModuleFileNameW CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW CreateMutexW ExpandEnvironmentStringsW GetTickCount64 SetCurrentDirectoryW ReadFile CreateProcessW GetLocaleInfoEx GetConsoleOutputCP CopyFileA OpenProcess IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetStdHandle GetEnvironmentVariableA GetCPInfo GetCurrentProcess GetSystemTime RtlPcToFileHeader LoadLibraryW SystemTimeToFileTime FileTimeToLocalFileTime LocalFree lstrcmpA FileTimeToSystemTime FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact GetSystemInfo HeapReAlloc DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock GlobalFree LCIDToLocaleName GetUserDefaultUILanguage LoadLibraryExW CreateDirectoryW FindFirstFileExW RemoveDirectoryW CopyFileW VerSetConditionMask VerifyVersionInfoW GetSystemFirmwareTable GetCommandLineW OpenFileMappingW OpenMutexW GetUserDefaultLocaleName GetCurrentThread GetNativeSystemInfo Module32FirstW GlobalMemoryStatusEx Module32NextW GetProcessTimes SetUnhandledExceptionFilter FreeEnvironmentStringsW K32GetModuleBaseNameW K32EnumProcessModules GetEnvironmentStringsW FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType TerminateProcess InterlockedPushEntrySList LCMapStringEx EncodePointer SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable QueryPerformanceFrequency IsProcessorFeaturePresent RtlUnwindEx PeekNamedPipe SystemTimeToTzSpecificLocalTime FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode GetStartupInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead InitOnceComplete InitOnceBeginInitialize GetStringTypeW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread CreateSymbolicLinkW RaiseException GetCurrentDirectoryW GetFileInformationByHandle SetFileInformationByHandle DeviceIoControl MoveFileExW CreateHardLinkW FreeLibrary GetFileInformationByHandleEx

user32

GetShellWindow GetCursorPos SetCursorPos GetWindowTextW SetWindowPos WindowFromPoint GetPhysicalCursorPos GetSystemMetrics GetForegroundWindow UnhookWinEvent FindWindowExW GetMessageW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow BeginPaint EndPaint InvalidateRect GetAsyncKeyState GetThreadDpiAwarenessContext SetClipboardData EnumDisplayMonitors EnumWindows FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect MonitorFromPoint EqualRect GetWindowThreadProcessId GetClassNameW ReleaseDC GetDC SendInput EndDialog CloseClipboard OpenClipboard SetClassLongPtrW PtInRect ScreenToClient SetCapture GetCapture TrackMouseEvent IsWindowVisible DialogBoxParamW SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer IsIconic ShowWindow IsWindow GetDpiForWindow GetWindowRect SetWindowTextW SetForegroundWindow ReleaseCapture SetFocus GetWindowPlacement FlashWindowEx PostMessageW EnumDisplaySettingsW ChangeWindowMessageFilterEx LoadIconW TrackPopupMenu GetWindow LoadCursorW RemoveMenu AppendMenuW InsertMenuW MonitorFromWindow UnregisterClassW IsZoomed GetClientRect AdjustWindowRectEx MapWindowPoints keybd_event FillRect SetWindowLongW GetWindowLongPtrW SendMessageW SetWindowLongPtrW SetWindowPlacement GetMenuItemCount OpenIcon EmptyClipboard DestroyMenu CreatePopupMenu GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW SetThreadDpiAwarenessContext UpdateWindow SetRectEmpty

gdi32

DeleteObject SelectObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateSolidBrush

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

GetUserNameW RegNotifyChangeKeyValue RegCreateKeyExW RegGetValueW EventUnregister RegCloseKey RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegDeleteValueW RegSetValueExW RegEnumKeyExW EventRegister EventSetInformation EventWriteTransfer

shell32

SHGetKnownFolderPath ShellExecuteW SHAppBarMessage SHQueryRecycleBinW SHEmptyRecycleBinW SHGetFolderPathW ShellExecuteExW CommandLineToArgvW Shell_NotifyIconW

ole32

CoCreateInstance RegisterDragDrop CoInitializeSecurity CoUninitialize CoTaskMemFree CoInitialize OleRun OleUninitialize CoSetProxyBlanket CreateStreamOnHGlobal CoTaskMemAlloc RevokeDragDrop CoAllowSetForegroundWindow OleInitialize CoCreateFreeThreadedMarshaler CoInitializeEx

oleaut32

VariantInit VariantChangeType SysStringLen VariantClear SysFreeString GetErrorInfo SetErrorInfo SysAllocString

iphlpapi

IcmpCreateFile GetAdaptersInfo IcmpCloseHandle

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CryptMsgGetParam CryptDecodeObjectEx CryptDecodeObject CryptMsgOpenToDecode CryptMsgClose CryptMsgUpdate CertOpenStore

ext-ms-win-networking-wlanapi-l1-1-0

WlanFreeMemory WlanGetAvailableNetworkList WlanEnumInterfaces WlanOpenHandle WlanCloseHandle

wlanapi

WlanAllocateMemory WlanRegisterNotification WlanScan

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptOpenAlgorithmProvider BCryptGenRandom BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider

gdiplus

GdipCloneImage GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDeleteMatrix GdipCreateMatrix GdipFree GdipAlloc GdipCreateBitmapFromHBITMAP GdiplusStartup GdipFlush GdipDrawImageI GdipCreateFromHDC GdipDisposeImage GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdiplusShutdown GdipFillEllipse GdipSetStringFormatAlign

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

dbghelp

SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 SymInitialize SymCleanup StackWalk64 SymSetOptions SymFromAddr

version

GetFileVersionInfoSizeW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

950KB

Virtual Size

950KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

199KB

Virtual Size

352KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

240KB

Virtual Size

239KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

313KB

Virtual Size

313KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_98c5ff54a5018af95075d92c025f6587_glassworm_icedid_luca-stealer_njrat_stealc_vidar

urlmon

ws2_32

winhttp

wininet

secur32

wtsapi32

shlwapi

dwmapi

api-ms-win-shcore-scaling-l1-1-1

msi

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

crypt32

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

api-ms-win-core-version-l1-1-0

api-ms-win-core-version-l1-1-1

bcrypt

gdiplus

setupapi

dbghelp

version

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic