2026-09-21_ea0adbae866065dca014250267f228a9_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-21_ea0adbae866065dca014250267f228a9_glassworm_icedid_luca-stealer_njrat_stealc
Size 82.9MB
Sample260922-laa3cssfqf
SHA256 d5cdc14feac6c099b6e3558f1b7046319d8abf54e0ccc559ffa3d39e944048a5
MD5 ea0adbae866065dca014250267f228a9
SHA1 97bf8da53277c6c2c8215be8af40a31bd63b8ee7
SHA512 44046d0a8a08695d57d441fb0561d021e263698d3724c52741e00445a0d7da2665346ece53392e90f92b3e69a78b97473e5f472d262c26765596e30582865579
SSDEEP 1572864:11F+FAlMLj7b2h8lMLj7b2hpzLxjXkO/hkoE:BMbqGMbqpzLxuoE
TLSH
T18E18E167A2A110FCC069D1BCDA8B5963F2B1781807759ACF57D00A421F7B7E4867EB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-21_ea0adbae866065dca014250267f228a9_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-21_ea0adbae866065dca014250267f228a9_glassworm_icedid_luca-stealer_njrat_stealc

.exe 82.9MB

2026-09-21_ea0adbae866065dca014250267f228a9_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH de1e23d5c31774c9146f712ff341bc7c
SHA256 d5cdc14feac6c099b6e3558f1b7046319d8abf54e0ccc559ffa3d39e944048a5
MD5 ea0adbae866065dca014250267f228a9
SHA1 97bf8da53277c6c2c8215be8af40a31bd63b8ee7
SHA512 44046d0a8a08695d57d441fb0561d021e263698d3724c52741e00445a0d7da2665346ece53392e90f92b3e69a78b97473e5f472d262c26765596e30582865579
SSDEEP 1572864:11F+FAlMLj7b2h8lMLj7b2hpzLxjXkO/hkoE:BMbqGMbqpzLxuoE
TLSH
T18E18E167A2A110FCC069D1BCDA8B5963F2B1781807759ACF57D00A421F7B7E4867EB23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

537944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteExA ShellExecuteW SHGetKnownFolderPath ShellExecuteExW SHGetFolderPathW

ole32

CoTaskMemFree CoInitializeEx

urlmon

URLDownloadToFileA

wininet

InternetReadFile InternetSetOptionA InternetCloseHandle InternetOpenUrlA HttpQueryInfoA InternetOpenA DeleteUrlCacheEntryA

advapi32

RegGetValueW EventWriteTransfer EventSetInformation EventRegister EventUnregister CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegQueryValueExW RegOpenKeyExW RegCloseKey CreateProcessWithTokenW GetTokenInformation DuplicateTokenEx OpenProcessToken

gdiplus

GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDrawImageRectI GdipFillEllipse GdipFillPolygon GdipFillRectangleI GdipDrawPolygon GdipDrawEllipse GdipDrawRectangle GdipDrawArc GdipDrawLine GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipSetCompositingQuality GdipSetCompositingMode GdipDeleteGraphics GdipCreateFromHDC GdipFlush GdipDrawString GdipCreateFont GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipSetPenLineJoin GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipMeasureString GdipDeleteStringFormat GdipSetStringFormatLineAlign GdipBitmapGetPixel GdipDeleteFont GdipBitmapSetPixel GdipCreateStringFormat GdipSetStringFormatAlign

dxgi

CreateDXGIFactory

kernel32

GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc CreateProcessW HeapAlloc GetCommandLineW GetCommandLineA ExitProcess GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx RaiseException RtlPcToFileHeader IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetEnvironmentVariableA CreateFileW DeleteFileW GetFileAttributesW GetFileAttributesExW GetLogicalDrives SetFileAttributesW GetTempPathW CloseHandle GetLastError SetLastError QueryPerformanceCounter WaitForSingleObject Sleep GetProcessTimes GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateRemoteThread GetExitCodeThread CreateProcessA ProcessIdToSessionId OpenProcess GetSystemTimeAsFileTime GetTickCount GetTickCount64 GetSystemDirectoryW VirtualAllocEx GetCurrentThreadId VirtualFreeEx FreeLibrary GetModuleFileNameW FlushFileBuffers GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource LocalFree FormatMessageA QueryFullProcessImageNameW FindResourceA CopyFileExW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW K32GetProcessMemoryInfo ReadFile WriteFile SetNamedPipeHandleState PeekNamedPipe GlobalMemoryStatusEx MulDiv GetConsoleWindow OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree LoadLibraryW GetEnvironmentVariableW GetCPInfo LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetStringTypeW CreateSymbolicLinkW WaitForSingleObjectEx GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFileW DeviceIoControl AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW SleepConditionVariableSRW GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx SetEndOfFile WriteConsoleW HeapSize SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation GetModuleHandleW ReadConsoleW GetLocaleInfoEx QueryPerformanceFrequency TryAcquireSRWLockExclusive ReleaseSRWLockExclusive WriteProcessMemory RtlUnwind AcquireSRWLockExclusive

user32

SendMessageW PostMessageW IsWindowVisible SetProcessDPIAware GetMonitorInfoW MonitorFromWindow LoadCursorW SetWindowLongW GetWindowLongW PtInRect FillRect ScreenToClient GetCursorPos SetCursor GetClientRect InvalidateRect EndPaint BeginPaint UpdateWindow DrawTextW GetSystemMetrics KillTimer SetTimer SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetMessageW TrackMouseEvent GetWindowThreadProcessId GetClassNameW EnumWindows FindWindowW EnumChildWindows MessageBoxW GetWindowRect GetWindowTextW GetAsyncKeyState ReleaseCapture

gdi32

SetTextColor SetBkMode SelectObject SelectClipRgn RoundRect LineTo GetStockObject DeleteObject DeleteDC CreateSolidBrush CreateRoundRectRgn CreateRectRgn CreatePen MoveToEx CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt

msimg32

GradientFill

dwmapi

DwmSetWindowAttribute

Name

.text

Size

736KB

Virtual Size

735KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

413KB

Virtual Size

412KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

81.7MB

Virtual Size

81.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_ea0adbae866065dca014250267f228a9_glassworm_icedid_luca-stealer_njrat_stealc

shell32

ole32

urlmon

wininet

advapi32

gdiplus

dxgi

kernel32

user32

gdi32

msimg32

dwmapi

generic