2026-09-23_11b60bc36c19cca2a4e138a36d6954fa_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_11b60bc36c19cca2a4e138a36d6954fa_glassworm_icedid_luca-stealer_njrat_stealc
Size 6.2MB
Sample260924-rertkaty2r
SHA256 2bf84eae1cb1ae7dadf471347c0d483a88b382680cf446c44d7619309ce60aa3
MD5 11b60bc36c19cca2a4e138a36d6954fa
SHA1 75532bca2836eed36bfb1bc1c38ca6593382b72e
SHA512 8d93999aa3378321840a6a9071ba1b3bbf94982d855e0d3cf905f359a51085d2cc41368a31923ea081bc8ec03ad0d8051959c71007f34ea1d9764f8ddde847d3
SSDEEP 49152:kEMVRoncvtn/0jZ1y7NMUg4iZO7bWV0eTKbemt7a8EBgjkLHhGruxbziyY:k7ZkZ1y/gibsH06xb+N
TLSH
T16266E9AAD6B742D5D4F9E034C256722BF8717CAEC5306357A741AB172B36B20E63E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_11b60bc36c19cca2a4e138a36d6954fa_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-23_11b60bc36c19cca2a4e138a36d6954fa_glassworm_icedid_luca-stealer_njrat_stealc

.exe 6.2MB

2026-09-23_11b60bc36c19cca2a4e138a36d6954fa_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 03c4b099d42256c744ed1afb84d2b971
SHA256 2bf84eae1cb1ae7dadf471347c0d483a88b382680cf446c44d7619309ce60aa3
MD5 11b60bc36c19cca2a4e138a36d6954fa
SHA1 75532bca2836eed36bfb1bc1c38ca6593382b72e
SHA512 8d93999aa3378321840a6a9071ba1b3bbf94982d855e0d3cf905f359a51085d2cc41368a31923ea081bc8ec03ad0d8051959c71007f34ea1d9764f8ddde847d3
SSDEEP 49152:kEMVRoncvtn/0jZ1y7NMUg4iZO7bWV0eTKbemt7a8EBgjkLHhGruxbziyY:k7ZkZ1y/gibsH06xb+N
TLSH
T16266E9AAD6B742D5D4F9E034C256722BF8717CAEC5306357A741AB172B36B20E63E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3884584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2050d_D20260901T155203\fa_rss\Release\PCAppStore.pdb

urlmon

URLDownloadToFileW CreateUri

ws2_32

shutdown WSAGetLastError WSAConnectByNameW WSAStartup setsockopt socket WSACleanup closesocket recv send

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpSetOption WinHttpQueryHeaders

wininet

InternetQueryDataAvailable HttpSendRequestW HttpOpenRequestW InternetReadFile InternetOpenUrlW InternetConnectW InternetCloseHandle InternetOpenW HttpQueryInfoW InternetSetOptionW HttpAddRequestHeadersW

secur32

FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW DeleteSecurityContext EncryptMessage DecryptMessage InitializeSecurityContextW ApplyControlToken FreeContextBuffer

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

shlwapi

PathCreateFromUrlW PathFindFileNameW AssocCreate PathRenameExtensionW PathAddBackslashW SHCreateStreamOnFileEx UrlCreateFromPathW

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

msi

ord70 ord45 ord32 ord118 ord8 ord160 ord159 ord92

kernel32

TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread InitializeCriticalSectionAndSpinCount RtlUnwind ExitThread WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle ReadConsoleW SetFilePointerEx GetFileSizeEx IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW WideCharToMultiByte DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesExW GetEnvironmentVariableW SetEnvironmentVariableW SetEvent ResetEvent CreateEventW Sleep WaitForMultipleObjects GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW CreateMutexW GetExitCodeProcess CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GetTickCount64 SetCurrentDirectoryW GetFullPathNameW ReadFile GetLocaleInfoEx GetConsoleOutputCP CopyFileA DuplicateHandle GetCurrentProcess IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetProcessId GetEnvironmentVariableA RtlPcToFileHeader FreeLibrary LoadLibraryW SystemTimeToFileTime FileTimeToLocalFileTime LocalFree lstrcmpA FileTimeToSystemTime FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact GetSystemInfo HeapReAlloc DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock GlobalFree LCIDToLocaleName GetUserDefaultUILanguage LoadLibraryExW CreateDirectoryW FindFirstFileExW ExpandEnvironmentStringsW RemoveDirectoryW CopyFileW VerSetConditionMask VerifyVersionInfoW GetSystemFirmwareTable GetCommandLineW FreeEnvironmentStringsW K32GetModuleBaseNameW K32EnumProcessModules GetEnvironmentStringsW OpenFileMappingW OpenMutexW GetUserDefaultLocaleName GetCurrentThread GetNativeSystemInfo Module32FirstW GlobalMemoryStatusEx Module32NextW GetProcessTimes SetUnhandledExceptionFilter FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType PeekNamedPipe CompareStringEx TerminateProcess LCMapStringEx EncodePointer AcquireSRWLockShared ReleaseSRWLockShared SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitOnceComplete InterlockedPushEntrySList RtlUnwindEx GetStdHandle SystemTimeToTzSpecificLocalTime FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead InitOnceBeginInitialize GetStringTypeW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceFrequency GetExitCodeThread CreateSymbolicLinkW RaiseException GetCurrentDirectoryW GetFileInformationByHandle SetFileInformationByHandle DeviceIoControl MoveFileExW CreateHardLinkW GetSystemTime GetFileInformationByHandleEx GetCPInfo

user32

GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext GetWindow LoadCursorW MonitorFromWindow UnregisterClassW IsZoomed SetActiveWindow GetClientRect AdjustWindowRectEx MapWindowPoints SendMessageW SetWindowLongPtrW SetWindowPlacement EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetClassLongPtrW SetWindowPos EnumDisplayMonitors EnumWindows FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect MonitorFromPoint GetClassNameW ReleaseDC GetDC SendInput EndDialog GetWindowTextW DialogBoxParamW GetWindowThreadProcessId PtInRect ScreenToClient SetCapture GetCapture GetKeyState TrackMouseEvent EnumDisplaySettingsW ChangeWindowMessageFilterEx GetShellWindow SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer IsIconic ShowWindow IsWindow GetDpiForWindow GetWindowRect SetWindowTextW SetForegroundWindow ReleaseCapture SetFocus GetWindowPlacement FlashWindowEx PostMessageW LoadIconW TrackPopupMenu RemoveMenu AppendMenuW SetCursorPos GetCursorPos keybd_event InsertMenuW GetMenuItemCount DestroyMenu GetForegroundWindow UnhookWinEvent FindWindowExW GetMessageW DefWindowProcW WindowFromPoint PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow BeginPaint EndPaint InvalidateRect CreatePopupMenu IsWindowVisible EqualRect GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW UpdateWindow GetWindowLongPtrW FillRect SetRectEmpty SetWindowLongW

gdi32

DeleteObject SelectObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateSolidBrush

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

GetUserNameW RegNotifyChangeKeyValue RegCreateKeyExW RegGetValueW EventUnregister RegCloseKey RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegDeleteValueW RegSetValueExW RegEnumKeyExW EventRegister EventSetInformation EventWriteTransfer

shell32

CommandLineToArgvW Shell_NotifyIconW SHChangeNotify ord190 ord155 SetCurrentProcessExplicitAppUserModelID SHGetKnownFolderItem SHGetIDListFromObject SHGetFolderPathW SHEmptyRecycleBinW SHQueryRecycleBinW ShellExecuteExW SHAppBarMessage SHGetKnownFolderPath ShellExecuteW

ole32

CoCreateInstance RegisterDragDrop OleRun CoTaskMemFree CoInitialize CoInitializeEx CoInitializeSecurity OleUninitialize CoSetProxyBlanket CreateStreamOnHGlobal PropVariantClear CoTaskMemAlloc RevokeDragDrop OleInitialize CoCreateFreeThreadedMarshaler CoUninitialize

oleaut32

VariantInit VariantChangeType SysStringLen VariantClear SysFreeString GetErrorInfo SetErrorInfo SysAllocString

iphlpapi

IcmpCreateFile GetAdaptersInfo IcmpCloseHandle

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CryptMsgGetParam CryptDecodeObjectEx CryptDecodeObject CryptMsgOpenToDecode CryptMsgClose CryptMsgUpdate CertOpenStore

ext-ms-win-networking-wlanapi-l1-1-0

WlanFreeMemory WlanGetAvailableNetworkList WlanEnumInterfaces WlanCloseHandle WlanOpenHandle

wlanapi

WlanAllocateMemory WlanRegisterNotification WlanScan

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptOpenAlgorithmProvider BCryptGenRandom BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider

gdiplus

GdipCloneImage GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDeleteMatrix GdipCreateMatrix GdipFree GdipAlloc GdiplusShutdown GdipCreateBitmapFromHBITMAP GdipFlush GdipDrawImageI GdipCreateFromHDC GdipDisposeImage GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipFillEllipse GdiplusStartup GdipSetStringFormatAlign

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

dbghelp

SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 SymInitialize SymCleanup StackWalk64 SymSetOptions SymFromAddr

version

GetFileVersionInfoSizeW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

207KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

251KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

403KB

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_11b60bc36c19cca2a4e138a36d6954fa_glassworm_icedid_luca-stealer_njrat_stealc

urlmon

ws2_32

winhttp

wininet

secur32

wtsapi32

shlwapi

dwmapi

api-ms-win-shcore-scaling-l1-1-1

msi

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

crypt32

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

api-ms-win-core-version-l1-1-0

api-ms-win-core-version-l1-1-1

bcrypt

gdiplus

setupapi

dbghelp

version

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic