2026-09-24_04b5406282e665beecb317bf8bcb9911_glassworm_icedid_luca-stealer_njrat_stealc

General

Target
2026-09-24_04b5406282e665beecb317bf8bcb9911_glassworm_icedid_luca-stealer_njrat_stealc
Size 16.4MB
Sample260925-tagtxazema
SHA256 3e9fbf95d83e9bec0c2cf1dfe8ef27489c48b1ae8a97cac9f3a07e94ac93be88
MD5 04b5406282e665beecb317bf8bcb9911
SHA1 6d92050c0eb21a6901061420e3d10e4e3be7fe9b
SHA512 edade19d5ca48bdef7ea716d55ec61aead7c3535c6cdefdebfc1063b7c8ed5b4b160d6b24af31fe4071034bbdcc938ae3fe10e447ff0307ad1e76eabc4d54bce
SSDEEP 196608:MrZcxYIT0nquIsATZ5/e8GVQqvUsdTSL5/JCq12Zv6njfvH4ZAyPt:7xYjnquPATfRGeqvbdTSLXhYAyl
TLSH
T1DA07D08DD1F4B1BCC97DD03C4C040C16C37978666B22476A2996CED979B31B92BFAB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_04b5406282e665beecb317bf8bcb9911_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-24_04b5406282e665beecb317bf8bcb9911_glassworm_icedid_luca-stealer_njrat_stealc

.exe 16.4MB

2026-09-24_04b5406282e665beecb317bf8bcb9911_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 84d32803265ce26160454f9465079221
SHA256 3e9fbf95d83e9bec0c2cf1dfe8ef27489c48b1ae8a97cac9f3a07e94ac93be88
MD5 04b5406282e665beecb317bf8bcb9911
SHA1 6d92050c0eb21a6901061420e3d10e4e3be7fe9b
SHA512 edade19d5ca48bdef7ea716d55ec61aead7c3535c6cdefdebfc1063b7c8ed5b4b160d6b24af31fe4071034bbdcc938ae3fe10e447ff0307ad1e76eabc4d54bce
SSDEEP 196608:MrZcxYIT0nquIsATZ5/e8GVQqvUsdTSL5/JCq12Zv6njfvH4ZAyPt:7xYjnquPATfRGeqvbdTSLXhYAyl
TLSH
T1DA07D08DD1F4B1BCC97DD03C4C040C16C37978666B22476A2996CED979B31B92BFAB24
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1995356

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlInitUnicodeString RtlPcToFileHeader RtlCaptureContext RtlUnwind

kernel32

HeapReAlloc WriteConsoleW GetModuleFileNameA GetLastError GetProcAddress ExitProcess GetModuleHandleW CreateToolhelp32Snapshot GetFileAttributesA Process32NextW Process32FirstW WideCharToMultiByte SizeofResource WriteFile GetModuleFileNameW EnumResourceNamesW GetTempPathW WaitForSingleObject CreateFileW SetFileAttributesW GetLogicalDriveStringsW EndUpdateResourceW LockResource DeleteFileW EnumResourceLanguagesW FindResourceExW LoadResource UpdateResourceW FreeLibrary BeginUpdateResourceW QueryFullProcessImageNameW GetTempFileNameW GetDriveTypeW LoadLibraryExW GetVolumeInformationW LocalFree GetComputerNameW GlobalMemoryStatusEx LoadLibraryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock FindFirstFileW FindNextFileW FindClose GetFileAttributesExW GetCurrentThreadId GetSystemTime ExitThread GetTickCount64 ResetEvent GetCurrentProcessId CreateEventA SetUnhandledExceptionFilter GetTimeZoneInformation GetSystemInfo GetLocalTime CreateDirectoryW ReadFile OpenEventA QueryDosDeviceW GetFileSizeEx GetLongPathNameW GetCurrentProcess RemoveDirectoryW SetFilePointer GetEnvironmentVariableW CreateMutexA GetFileAttributesW UnmapViewOfFile MultiByteToWideChar SetEvent TerminateThread CloseHandle CreateThread GetCurrentDirectoryW MoveFileExW CreateFileMappingW MapViewOfFile SetDllDirectoryW GetLogicalDrives TerminateProcess GetDriveTypeA CreatePipe SetErrorMode OpenProcess GetTempPathA K32GetProcessMemoryInfo CreateFileA FileTimeToSystemTime SetFilePointerEx CreateProcessW CreateProcessA GetDiskFreeSpaceExA MoveFileW CompareStringOrdinal Sleep FindResourceW GetConsoleWindow AllocConsole AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW GetVersionExW HeapValidate HeapSize FormatMessageW GetDiskFreeSpaceA OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA SetEnvironmentVariableW RaiseException HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetFileSize DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime FormatMessageA QueryPerformanceCounter GetTickCount FlushFileBuffers CreateNamedPipeW PeekNamedPipe ConnectNamedPipe FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetExitCodeThread InitOnceComplete InitOnceBeginInitialize QueryPerformanceFrequency SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable FindFirstFileExW GetFinalPathNameByHandleW GetFileInformationByHandleEx GetLocaleInfoEx LCMapStringEx InitializeCriticalSectionEx EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

756KB

Virtual Size

755KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13.3MB

Virtual Size

13.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_04b5406282e665beecb317bf8bcb9911_glassworm_icedid_luca-stealer_njrat_stealc

ntdll

kernel32

generic