Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 20:53
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-25_b43ea295e584386d21d587021313b4f2_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260911-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-25_b43ea295e584386d21d587021313b4f2_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260911-en
1 signatures
150 seconds
General
- Target 2026-09-25_b43ea295e584386d21d587021313b4f2_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat.exe
- Size 15.0MB
- Sample260925-zpcrdsxt6p
- SHA256 5c42462c1d95884930b0ff7c2c4a2c7c4fb42121fe6063b09a84de2cd8f88d14
- MD5 b43ea295e584386d21d587021313b4f2
- SHA1 4a40384e1e484d7599fe16b33a6c7d3a74102198
- SHA512 6128b0ddcc642eabb476b1b0e46ad4c4eea28615ccd9cc54e2e20065ee2b441d23f64727efdcb4e4af78f84febd7e15103f798ef498f6d1621e575dac307e2ff
- SSDEEP 98304:/skhjqgEsas/YNB6h9PKHsFsRkX+JwE2jQaR3F3i1t9mTj04h2H8akX8I:EkhjqgEsa4Y6hBKHsFgE0tmth2Vkr
- TLSH T1A2F6AE301FA420EDED5BC4F9CF19164AED31B40B933066BB58D6EE312DA77109AB9B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-09-25_b43ea295e584386d21d587021313b4f2_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-09-25_b43ea295e584386d21d587021313b4f2_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-25_b43ea295e584386d21d587021313b4f2_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-25_b43ea295e584386d21d587021313b4f2_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
PID:3872