2026-09-25_e1424a96623927a76ab3a84941c61c22_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_e1424a96623927a76ab3a84941c61c22_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat
Size 15.0MB
Sample260925-w4bwvstdlg
SHA256 7876717ae85cf4536162b3130dd8993da51c66ea953f0ebb20011529bd4f5fa6
MD5 e1424a96623927a76ab3a84941c61c22
SHA1 9f602fc651c4e4f5d584168002e61c407a903955
SHA512 d06b38f468cbb7d1a1008f981427c33b027f0ad5900cda60678bdfbad83d47d7e00ed6e1e081274e52fadc95f3d356a5556ad5b7329f8e28f653b6d4f9562e38
SSDEEP 98304:trD6pBrC8kvvv7DqGYEbrIymO6xi1t9mTj04h2H8akX8j:trD6w8kXv3/wO1tmth2VkQ
TLSH
T1A4F6AD345FA420EED85BC4F9CF18564EED30740B8330A6BB59E5EE311DA7700A6B9B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-25_e1424a96623927a76ab3a84941c61c22_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat

File Explorer

2026-09-25_e1424a96623927a76ab3a84941c61c22_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat

.exe 15.0MB

2026-09-25_e1424a96623927a76ab3a84941c61c22_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat

IMPHASH c69ef4a5d82e6592d8d0c76e1ff14178
SHA256 7876717ae85cf4536162b3130dd8993da51c66ea953f0ebb20011529bd4f5fa6
MD5 e1424a96623927a76ab3a84941c61c22
SHA1 9f602fc651c4e4f5d584168002e61c407a903955
SHA512 d06b38f468cbb7d1a1008f981427c33b027f0ad5900cda60678bdfbad83d47d7e00ed6e1e081274e52fadc95f3d356a5556ad5b7329f8e28f653b6d4f9562e38
SSDEEP 98304:trD6pBrC8kvvv7DqGYEbrIymO6xi1t9mTj04h2H8akX8j:trD6w8kXv3/wO1tmth2VkQ
TLSH
T1A4F6AD345FA420EED85BC4F9CF18564EED30740B8330A6BB59E5EE311DA7700A6B9B52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables (downlaoders) containing URLs to raw contents of a paste
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ef:8f:a7:f8:37:4b:6b:68:60:d3:2e:a6:43:e3:1b:73:35:52:e1:71:43:d7:a9:8c:6a:94:d4:ac:b8:15:85:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=CS Cheat Check (self-signed),O=CS Cheat Check

Chains

Sep 25, 2026

CN=CS Cheat Check (self-signed),O=CS Cheat Check

Minor OS version

Major OS version

Entry point

7941072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

CsCheatCheck.pdb

setupapi

SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailW SetupDiOpenDevRegKey SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW SetupDiGetDevicePropertyW SetupDiDestroyDeviceInfoList CM_Get_DevNode_Status

shlwapi

ord12

advapi32

EventWriteTransfer EventRegister EventUnregister RegGetValueW EventSetInformation GetUserNameA ConvertStringSecurityDescriptorToSecurityDescriptorW GetUserNameW ConvertSidToStringSidA LookupPrivilegeValueW RegEnumKeyExA SetSecurityDescriptorDacl AllocateAndInitializeSid AddAccessDeniedAce RegQueryValueExW RegOpenKeyExW RegCloseKey GetTokenInformation OpenServiceA RegEnumValueW LookupAccountSidW RegEnumValueA ConvertSidToStringSidW RegOpenKeyExA RegLoadKeyW RegUnLoadKeyW OpenEventLogW OpenProcessToken StartServiceA RegEnumKeyExW ControlService ConvertStringSidToSidW ReadEventLogW CloseEventLog OpenSCManagerA LookupPrivilegeValueA RegQueryValueExA CloseServiceHandle QueryServiceStatus RegQueryInfoKeyW RegEnumKeyW AdjustTokenPrivileges AddAccessAllowedAce GetLengthSid SetKernelObjectSecurity InitializeAcl InitializeSecurityDescriptor FreeSid

user32

ReleaseCapture SetWindowLongPtrA GetWindowLongPtrA SetForegroundWindow IsIconic SendMessageA DisplayConfigGetDeviceInfo PostMessageW MapVirtualKeyW ScreenToClient GetAsyncKeyState GetCursorPos GetIconInfo wsprintfA EnumDisplayMonitors QueryDisplayConfig GetDisplayConfigBufferSizes DestroyIcon DrawIconEx GetDC FillRect IsWindow GetForegroundWindow SetLayeredWindowAttributes BringWindowToTop ReleaseDC wsprintfW DefWindowProcW GetMessageA LoadImageA DispatchMessageA LoadCursorA CallNextHookEx RegisterClassExW UnhookWindowsHookEx DefWindowProcA SetWindowsHookExW LoadIconA GetClientRect KillTimer PostQuitMessage GetWindowThreadProcessId IsWindowVisible MonitorFromWindow PostMessageA GetRawInputDeviceInfoW ClientToScreen GetWindowTextA GetMonitorInfoA EnumWindows FindWindowA GetRawInputDeviceList DestroyWindow CreateWindowExW SendMessageW GetSystemMetrics DispatchMessageW PeekMessageW TranslateMessage SystemParametersInfoW UpdateWindow GetWindowRect SetWindowPos MessageBoxW SetWindowRgn ShowWindow MessageBoxA FindWindowW

gdi32

GetDIBits GetObjectA BitBlt CreateDIBSection CreateCompatibleDC DeleteDC SelectObject CreateFontW GetStockObject TextOutW GetTextExtentPoint32W SetTextColor SetBkMode CreatePen Rectangle CreateSolidBrush DeleteObject CreateFontIndirectW CreateRoundRectRgn

kernel32

InitializeCriticalSectionAndSpinCount SetLastError RtlPcToFileHeader RtlUnwindEx GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer TlsAlloc InitializeCriticalSectionEx GetNativeSystemInfo GetExitCodeThread AcquireSRWLockShared ReleaseSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW ExitThread FreeLibraryAndExitThread GetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW SetDefaultDllDirectories GetCurrentProcess TerminateProcess GetUserDefaultUILanguage CreateMutexW Sleep GetLastError CloseHandle QueryPerformanceCounter MulDiv SetUnhandledExceptionFilter CreateDirectoryW SizeofResource FindFirstFileW FindNextFileW WriteFile ExpandEnvironmentStringsW RemoveDirectoryW GetModuleFileNameW GetEnvironmentVariableW GetTempPathW FindClose WaitForSingleObject CreateFileW GetFileAttributesW GetFileAttributesExW FreeEnvironmentStringsW DeleteFileW LoadLibraryW LoadResource FindResourceW GetLocalTime GetProcAddress GetCurrentProcessId CreateProcessW GetModuleHandleW WideCharToMultiByte GetTickCount GetExitCodeProcess GetTickCount64 GetFileAttributesA FreeLibrary GetCurrentThreadId MultiByteToWideChar GetTempPathA ReadFile GetVolumeInformationW GetLogicalDrives LCMapStringW DeviceIoControl FindNextFileA CreateFileA FileTimeToSystemTime LoadLibraryA GetWindowsDirectoryA GetFileSize GlobalMemoryStatusEx GetDriveTypeW SystemTimeToTzSpecificLocalTime QueryDosDeviceW CompareFileTime MoveFileA GetFileSizeEx HeapFree GetLongPathNameW ExpandEnvironmentStringsA GetSystemDirectoryW GetCurrentDirectoryA GetLogicalDriveStringsW CopyFileA MoveFileExA GetSystemDirectoryA DeleteFileA HeapAlloc GetWindowsDirectoryW SetFilePointerEx LocalFree RemoveDirectoryA FindFirstStreamW GetProcessHeap SystemTimeToFileTime CopyFileW CreateProcessA GetSystemTimeAsFileTime CreateDirectoryA FindNextStreamW CompareStringOrdinal FindResourceA GetEnvironmentVariableA GetModuleHandleExA GetCurrentThread SetProcessMitigationPolicy RtlUnwind lstrcatA CancelWaitableTimer CloseThreadpoolTimer lstrcpyA SetThreadpoolTimer CreateThreadpoolTimer VirtualQuery GetDriveTypeA GetVolumeInformationA GetDiskFreeSpaceExA SetThreadPriority CreateThread GetFileAttributesExA CreateToolhelp32Snapshot Process32NextW Process32FirstW GetFileInformationByHandleEx MoveFileExW FlushFileBuffers PurgeComm GetCommState SetCommTimeouts SetCommState SetFileAttributesA GetComputerNameW QueryFullProcessImageNameW CreateEventW CancelIoEx GetOverlappedResult FindFirstFileExW GetSystemInfo OpenMutexA IsDebuggerPresent CheckRemoteDebuggerPresent GetModuleHandleA GetModuleFileNameA GetProcessWorkingSetSize VirtualUnlock VirtualLock SetProcessWorkingSetSize QueryPerformanceFrequency GetLocaleInfoW IsValidLocale GetLocaleInfoEx SleepConditionVariableSRW WakeAllConditionVariable GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation WakeConditionVariable InitOnceBeginInitialize InitOnceComplete MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime DeleteCriticalSection LockFileEx UnlockFile HeapDestroy HeapCompact RaiseException HeapReAlloc WaitForSingleObjectEx FlushViewOfFile GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate UnmapViewOfFile UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection LeaveCriticalSection LockFile GetDiskFreeSpaceW GetFullPathNameW EnterCriticalSection HeapCreate TryEnterCriticalSection AreFileApisANSI LoadLibraryExW OutputDebugStringW OutputDebugStringA SetEnvironmentVariableW SetStdHandle ReadConsoleW FindFirstFileA GetConsoleMode WriteConsoleW LockResource WaitForThreadpoolTimerCallbacks

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

comctl32

InitCommonControlsEx

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

crypt32

CertCloseStore CertGetNameStringA CertEnumCertificatesInStore CertOpenSystemStoreA CertGetCertificateContextProperty CertFreeCertificateContext CryptProtectData CryptUnprotectData

bcrypt

BCryptGenRandom BCryptHash

ole32

CoTaskMemFree CoTaskMemAlloc StgOpenStorage CoInitializeEx CoInitializeSecurity CoUninitialize CoSetProxyBlanket CoCreateInstance

oleaut32

VariantClear SysAllocString SysFreeString VariantInit VariantTimeToSystemTime

shell32

SHGetFileInfoW ExtractIconExW ord25 SHGetPathFromIDListW ord680 ShellExecuteW SHOpenFolderAndSelectItems ShellExecuteA SHGetFolderPathA SHParseDisplayName SHFileOperationW SHGetKnownFolderPath SHGetNameFromIDList SHGetFolderPathW ord18

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

dnsapi

DnsFree DnsQuery_A

Name

.text

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

232KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_e1424a96623927a76ab3a84941c61c22_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat

PE Signature issue

setupapi

shlwapi

advapi32

user32

gdi32

kernel32

dwmapi

comctl32

d3d11

dxgi

crypt32

bcrypt

ole32

oleaut32

shell32

version

dnsapi

generic