2026-09-25_8005f361e15838c18be8d4baa6d9f8c0_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_8005f361e15838c18be8d4baa6d9f8c0_glassworm_icedid_luca-stealer_njrat_stealc
Size 76.9MB
Sample260925-3wpajszbma
SHA256 4b84792e34055d12f1108ec7651e3fe810dfc4eb4331ab9dbb49596db162aa08
MD5 8005f361e15838c18be8d4baa6d9f8c0
SHA1 13b732c562f54b85f612541a1a33ef8b1db6dae5
SHA512 940898217e99985316f5b5a5f3e8963e970b5b078c7b321efa48ed4417fc91f28a231584647a547be831a7481c8c232c983e4d810d71e5e0fad9f08e8722d9d1
SSDEEP 1572864:8Tl1F2l1FulMLj7b2h8lMLj7b2hpzLxjXkO/h2o:eMbqGMbqpzLxso
TLSH
T1E708F16792A111FCC06AD0BCDA875822E2B0385947749ADB17E00E525F7B7E4C67FB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_8005f361e15838c18be8d4baa6d9f8c0_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-25_8005f361e15838c18be8d4baa6d9f8c0_glassworm_icedid_luca-stealer_njrat_stealc

.exe 76.9MB

2026-09-25_8005f361e15838c18be8d4baa6d9f8c0_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 166982b65229499071695b1187032eb4
SHA256 4b84792e34055d12f1108ec7651e3fe810dfc4eb4331ab9dbb49596db162aa08
MD5 8005f361e15838c18be8d4baa6d9f8c0
SHA1 13b732c562f54b85f612541a1a33ef8b1db6dae5
SHA512 940898217e99985316f5b5a5f3e8963e970b5b078c7b321efa48ed4417fc91f28a231584647a547be831a7481c8c232c983e4d810d71e5e0fad9f08e8722d9d1
SSDEEP 1572864:8Tl1F2l1FulMLj7b2h8lMLj7b2hpzLxjXkO/h2o:eMbqGMbqpzLxso
TLSH
T1E708F16792A111FCC06AD0BCDA875822E2B0385947749ADB17E00E525F7B7E4C67FB23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

526280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteExA ShellExecuteW SHGetKnownFolderPath ShellExecuteExW SHGetFolderPathW

ole32

CoTaskMemFree CoInitializeEx

urlmon

URLDownloadToFileA

wininet

InternetReadFile InternetSetOptionA InternetCloseHandle InternetOpenUrlA HttpQueryInfoA InternetOpenA DeleteUrlCacheEntryA

advapi32

RegGetValueW EventWriteTransfer EventSetInformation EventRegister EventUnregister CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegQueryValueExW RegOpenKeyExW RegCloseKey CreateProcessWithTokenW GetTokenInformation DuplicateTokenEx OpenProcessToken

gdiplus

GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDrawImageRectI GdipFillEllipse GdipFillPolygon GdipFillRectangleI GdipDrawPolygon GdipDrawEllipse GdipDrawRectangle GdipDrawArc GdipDrawLine GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipSetCompositingQuality GdipSetCompositingMode GdipDeleteGraphics GdipCreateFromHDC GdipFlush GdipDrawString GdipCreateFont GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipSetPenLineJoin GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipMeasureString GdipDeleteStringFormat GdipSetStringFormatLineAlign GdipBitmapGetPixel GdipDeleteFont GdipBitmapSetPixel GdipCreateStringFormat GdipSetStringFormatAlign

dxgi

CreateDXGIFactory

kernel32

GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc CreateProcessW HeapAlloc GetCommandLineW GetCommandLineA ExitProcess GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx RaiseException RtlPcToFileHeader IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetEnvironmentVariableA CreateFileW DeleteFileW GetFileAttributesW GetFileAttributesExW GetLogicalDrives SetFileAttributesW GetTempPathW CloseHandle GetLastError SetLastError QueryPerformanceCounter WaitForSingleObject Sleep GetProcessTimes GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateRemoteThread GetExitCodeThread CreateProcessA ProcessIdToSessionId OpenProcess GetSystemTimeAsFileTime GetTickCount GetTickCount64 VirtualAllocEx GetCurrentThreadId VirtualFreeEx FreeLibrary GetModuleFileNameW FlushFileBuffers GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource LocalFree FormatMessageA QueryFullProcessImageNameW FindResourceA CopyFileExW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW K32GetProcessMemoryInfo ReadFile WriteFile SetNamedPipeHandleState PeekNamedPipe GlobalMemoryStatusEx MulDiv GetConsoleWindow OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree LoadLibraryW GetEnvironmentVariableW GetCPInfo LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetStringTypeW CreateSymbolicLinkW WaitForSingleObjectEx GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CopyFileW DeviceIoControl AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW SleepConditionVariableSRW GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx SetEndOfFile WriteConsoleW HeapSize SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation GetModuleHandleW ReadConsoleW GetLocaleInfoEx QueryPerformanceFrequency TryAcquireSRWLockExclusive ReleaseSRWLockExclusive WriteProcessMemory RtlUnwind AcquireSRWLockExclusive

user32

SendMessageW PostMessageW IsWindowVisible SetProcessDPIAware GetMonitorInfoW MonitorFromWindow LoadCursorW SetWindowLongW GetWindowLongW PtInRect FillRect ScreenToClient GetCursorPos SetCursor GetClientRect InvalidateRect EndPaint BeginPaint UpdateWindow DrawTextW GetSystemMetrics KillTimer SetTimer SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage GetMessageW TrackMouseEvent GetWindowThreadProcessId GetClassNameW EnumWindows FindWindowW EnumChildWindows MessageBoxW GetWindowRect GetWindowTextW GetAsyncKeyState ReleaseCapture

gdi32

SetTextColor SetBkMode SelectObject SelectClipRgn RoundRect LineTo GetStockObject DeleteObject DeleteDC CreateSolidBrush CreateRoundRectRgn CreateRectRgn CreatePen MoveToEx CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt

msimg32

GradientFill

dwmapi

DwmSetWindowAttribute

Name

.text

Size

724KB

Virtual Size

724KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

405KB

Virtual Size

404KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

75.8MB

Virtual Size

75.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_8005f361e15838c18be8d4baa6d9f8c0_glassworm_icedid_luca-stealer_njrat_stealc

shell32

ole32

urlmon

wininet

advapi32

gdiplus

dxgi

kernel32

user32

gdi32

msimg32

dwmapi

generic