2026-09-25_e6d43ddfdd1dd3f1be1e4dc5505adbe6_glassworm_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_e6d43ddfdd1dd3f1be1e4dc5505adbe6_glassworm_icedid_njrat_stealc
Size 2.5MB
Sample260925-wp49vsshng
SHA256 bb7bf84a8189a3a7ed50aa4d0321723926bbcfba47dafc44fd57a6f0899a37ed
MD5 e6d43ddfdd1dd3f1be1e4dc5505adbe6
SHA1 a2c312d07c789324172a00c7fb6e0ebcb82519fb
SHA512 14609da7a00b24aa7846a1c5d0d9ad4323e4cb9693e97c5928212a4f43e3f9b16d25f84ce09bd87a194166aec0c9f21b993ea4d3b8e1ace73986cc02a4334b60
SSDEEP 49152:7l/NFDx7eLl8wmb4KVBQw+NmLuJ8H9MKofPEzWjNWd9:7tDCSVfSfPEzcNW
TLSH
T17DC58C37629D16ECD366C1788B958992D3713CCD03306AEF07B049A69EE76D05F3A392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_e6d43ddfdd1dd3f1be1e4dc5505adbe6_glassworm_icedid_njrat_stealc

File Explorer

2026-09-25_e6d43ddfdd1dd3f1be1e4dc5505adbe6_glassworm_icedid_njrat_stealc

.exe 2.5MB

2026-09-25_e6d43ddfdd1dd3f1be1e4dc5505adbe6_glassworm_icedid_njrat_stealc

IMPHASH 16fb00a49ec6a88453b24ee660c01d16
SHA256 bb7bf84a8189a3a7ed50aa4d0321723926bbcfba47dafc44fd57a6f0899a37ed
MD5 e6d43ddfdd1dd3f1be1e4dc5505adbe6
SHA1 a2c312d07c789324172a00c7fb6e0ebcb82519fb
SHA512 14609da7a00b24aa7846a1c5d0d9ad4323e4cb9693e97c5928212a4f43e3f9b16d25f84ce09bd87a194166aec0c9f21b993ea4d3b8e1ace73986cc02a4334b60
SSDEEP 49152:7l/NFDx7eLl8wmb4KVBQw+NmLuJ8H9MKofPEzWjNWd9:7tDCSVfSfPEzcNW
TLSH
T17DC58C37629D16ECD366C1788B958992D3713CCD03306AEF07B049A69EE76D05F3A392
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1300432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FindFirstFileW FindNextFileW GetCurrentProcessId K32GetModuleFileNameExW GetSystemTimePreciseAsFileTime SetUnhandledExceptionFilter AddVectoredExceptionHandler QueryPerformanceCounter QueryPerformanceFrequency CreateProcessW GetSystemTimeAsFileTime GetLocalTime IsWow64Process K32EnumProcessModulesEx K32GetModuleBaseNameW K32GetModuleInformation OpenThread GetThreadContext Thread32First Thread32Next FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree LocalAlloc LocalFree GetComputerNameA SetEndOfFile SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP CreateFileA IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap K32GetModuleFileNameExA OutputDebugStringW SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapReAlloc HeapAlloc HeapFree Module32NextW Module32FirstW MultiByteToWideChar GetTickCount64 GetTickCount CreateProcessA TerminateProcess WaitForSingleObject DeviceIoControl PeekNamedPipe CreatePipe SetHandleInformation DeleteFileA GetEnvironmentVariableA GetTempPathW WriteFile GetTempPathA GetFileAttributesA GetModuleFileNameA FindNextFileA GetModuleHandleA Sleep GetFirmwareEnvironmentVariableW K32GetDeviceDriverFileNameW K32EnumDeviceDrivers GetSystemWindowsDirectoryW GetFileSize GetFileAttributesExA K32GetMappedFileNameW Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte QueryFullProcessImageNameW GetProcAddress GetModuleHandleW ReadProcessMemory VirtualQueryEx OpenProcess GetCurrentProcess GetProcessTimes GetLastError FindFirstFileA GetTimeZoneInformation FindClose ExitProcess FreeLibraryAndExitThread ExitThread CreateThread HeapSize WriteConsoleW GetModuleHandleExW CreateFileW CloseHandle ReadFile GetFileTime GetFileSizeEx GetACP GetModuleFileNameW GetFileType GetStdHandle LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer FindFirstFileExW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwind

user32

SendMessageA DefWindowProcA PostQuitMessage RegisterClassW UnregisterClassW CreateWindowExW IsWindow DestroyWindow ShowWindow SetTimer KillTimer GetSystemMetrics UpdateWindow BeginPaint EndPaint IsWindowVisible GetWindowTextW GetWindowTextLengthW EnumWindows GetWindowThreadProcessId GetMessageA TranslateMessage SetWindowRgn InvalidateRect GetClientRect ScreenToClient FillRect LoadCursorA wsprintfW GetClassInfoW DispatchMessageA PostMessageA ReleaseCapture PeekMessageA

gdi32

SetBkMode CreatePen CreateRoundRectRgn DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt TextOutW MoveToEx SetTextColor SetTextCharacterExtra CreateFontW SelectObject RoundRect LineTo GetTextExtentPoint32W GetStockObject DeleteObject CreateSolidBrush

advapi32

OpenSCManagerA AdjustTokenPrivileges LookupPrivilegeValueW GetUserNameA RegCloseKey RegOpenKeyExW RegQueryValueExW RegEnumKeyExA QueryServiceStatusEx QueryServiceConfigA OpenServiceA FreeSid CheckTokenMembership AllocateAndInitializeSid OpenProcessToken EnumServicesStatusExA CloseServiceHandle RegQueryValueExA RegQueryInfoKeyA RegOpenKeyExA RegEnumValueA

iphlpapi

GetAdaptersAddresses GetExtendedTcpTable

dbghelp

SymSetOptions StackWalk64 SymFunctionTableAccess64 SymCleanup SymGetModuleBase64 SymInitialize ImageDirectoryEntryToData

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringA CryptQueryObject CryptMsgClose CryptMsgGetParam

bcrypt

BCryptGetProperty BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

wevtapi

EvtClose EvtFormatMessage EvtOpenPublisherMetadata EvtRender EvtNext EvtQuery

wintrust

WinVerifyTrust

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpQueryHeaders WinHttpSetTimeouts WinHttpOpenRequest WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen

ole32

CoInitializeEx CoUninitialize

shell32

SHGetFolderPathA

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

962KB

Virtual Size

962KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_e6d43ddfdd1dd3f1be1e4dc5505adbe6_glassworm_icedid_njrat_stealc

kernel32

user32

gdi32

advapi32

iphlpapi

dbghelp

crypt32

bcrypt

wevtapi

wintrust

winhttp

ole32

shell32

generic