2026-09-25_b43ea295e584386d21d587021313b4f2_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_b43ea295e584386d21d587021313b4f2_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat
Size 15.0MB
Sample260925-zpcrdsxt6p
SHA256 5c42462c1d95884930b0ff7c2c4a2c7c4fb42121fe6063b09a84de2cd8f88d14
MD5 b43ea295e584386d21d587021313b4f2
SHA1 4a40384e1e484d7599fe16b33a6c7d3a74102198
SHA512 6128b0ddcc642eabb476b1b0e46ad4c4eea28615ccd9cc54e2e20065ee2b441d23f64727efdcb4e4af78f84febd7e15103f798ef498f6d1621e575dac307e2ff
SSDEEP 98304:/skhjqgEsas/YNB6h9PKHsFsRkX+JwE2jQaR3F3i1t9mTj04h2H8akX8I:EkhjqgEsa4Y6hBKHsFgE0tmth2Vkr
TLSH
T1A2F6AE301FA420EDED5BC4F9CF19164AED31B40B933066BB58D6EE312DA77109AB9B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-25_b43ea295e584386d21d587021313b4f2_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat

File Explorer

2026-09-25_b43ea295e584386d21d587021313b4f2_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat

.exe 15.0MB

2026-09-25_b43ea295e584386d21d587021313b4f2_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat

IMPHASH 1c56fc5d0b4ec2681e0c9969d548b25a
SHA256 5c42462c1d95884930b0ff7c2c4a2c7c4fb42121fe6063b09a84de2cd8f88d14
MD5 b43ea295e584386d21d587021313b4f2
SHA1 4a40384e1e484d7599fe16b33a6c7d3a74102198
SHA512 6128b0ddcc642eabb476b1b0e46ad4c4eea28615ccd9cc54e2e20065ee2b441d23f64727efdcb4e4af78f84febd7e15103f798ef498f6d1621e575dac307e2ff
SSDEEP 98304:/skhjqgEsas/YNB6h9PKHsFsRkX+JwE2jQaR3F3i1t9mTj04h2H8akX8I:EkhjqgEsa4Y6hBKHsFgE0tmth2Vkr
TLSH
T1A2F6AE301FA420EDED5BC4F9CF19164AED31B40B933066BB58D6EE312DA77109AB9B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables (downlaoders) containing URLs to raw contents of a paste
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

4f:23:78:2a:3a:77:fa:be:9e:e0:be:ae:bf:97:d0:2f:6f:df:7d:5f:19:22:ea:e9:0a:4d:b3:b8:98:52:65:d5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=CS Cheat Check (self-signed),O=CS Cheat Check

Chains

Sep 25, 2026

CN=CS Cheat Check (self-signed),O=CS Cheat Check

Minor OS version

Major OS version

Entry point

7903872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

CsCheatCheck.pdb

setupapi

SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailW SetupDiOpenDevRegKey SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW SetupDiGetDevicePropertyW SetupDiDestroyDeviceInfoList CM_Get_DevNode_Status

shlwapi

ord12

advapi32

EventRegister GetUserNameA ConvertStringSecurityDescriptorToSecurityDescriptorW EventSetInformation EventWriteTransfer EventUnregister RegGetValueW GetUserNameW ConvertSidToStringSidA LookupPrivilegeValueW RegEnumKeyExA SetSecurityDescriptorDacl AllocateAndInitializeSid AddAccessDeniedAce RegQueryValueExW RegOpenKeyExW RegCloseKey GetTokenInformation OpenServiceA RegEnumValueW LookupAccountSidW RegEnumValueA ConvertSidToStringSidW RegOpenKeyExA RegLoadKeyW RegUnLoadKeyW OpenEventLogW OpenProcessToken StartServiceA RegEnumKeyExW ControlService ConvertStringSidToSidW ReadEventLogW CloseEventLog OpenSCManagerA LookupPrivilegeValueA RegQueryValueExA CloseServiceHandle QueryServiceStatus RegQueryInfoKeyW RegEnumKeyW AdjustTokenPrivileges AddAccessAllowedAce GetLengthSid SetKernelObjectSecurity InitializeAcl InitializeSecurityDescriptor FreeSid

user32

ReleaseCapture SetWindowLongPtrA GetWindowLongPtrA SetForegroundWindow IsIconic SendMessageA DisplayConfigGetDeviceInfo PostMessageW MapVirtualKeyW ScreenToClient GetAsyncKeyState GetCursorPos GetIconInfo wsprintfA EnumDisplayMonitors QueryDisplayConfig GetDisplayConfigBufferSizes DestroyIcon DrawIconEx GetDC FillRect IsWindow GetForegroundWindow SetLayeredWindowAttributes BringWindowToTop ReleaseDC wsprintfW DefWindowProcW GetMessageA LoadImageA DispatchMessageA LoadCursorA CallNextHookEx RegisterClassExW UnhookWindowsHookEx DefWindowProcA SetWindowsHookExW LoadIconA GetClientRect KillTimer PostQuitMessage GetWindowThreadProcessId IsWindowVisible MonitorFromWindow PostMessageA GetRawInputDeviceInfoW ClientToScreen GetWindowTextA GetMonitorInfoA EnumWindows FindWindowA GetRawInputDeviceList DestroyWindow CreateWindowExW SendMessageW GetSystemMetrics DispatchMessageW PeekMessageW TranslateMessage SystemParametersInfoW UpdateWindow GetWindowRect SetWindowPos MessageBoxW SetWindowRgn ShowWindow MessageBoxA FindWindowW

gdi32

GetDIBits GetObjectA BitBlt CreateDIBSection CreateCompatibleDC DeleteDC SelectObject CreateFontW GetStockObject TextOutW GetTextExtentPoint32W SetTextColor SetBkMode CreatePen Rectangle CreateSolidBrush DeleteObject CreateFontIndirectW CreateRoundRectRgn

kernel32

RtlPcToFileHeader RtlUnwindEx GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer SetLastError InitializeCriticalSectionEx GetNativeSystemInfo GetExitCodeThread AcquireSRWLockShared ReleaseSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW ExitThread FreeLibraryAndExitThread GetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW SetDefaultDllDirectories GetCurrentProcess TerminateProcess GetUserDefaultUILanguage CreateMutexW Sleep GetLastError CloseHandle QueryPerformanceCounter MulDiv SetUnhandledExceptionFilter CreateDirectoryW SizeofResource FindFirstFileW FindNextFileW WriteFile ExpandEnvironmentStringsW RemoveDirectoryW GetModuleFileNameW GetEnvironmentVariableW GetTempPathW FindClose WaitForSingleObject CreateFileW GetFileAttributesW GetFileAttributesExW LCMapStringW DeleteFileW LoadLibraryW LoadResource FindResourceW GetLocalTime GetProcAddress GetCurrentProcessId CreateProcessW GetModuleHandleW WideCharToMultiByte GetTickCount GetExitCodeProcess GetTickCount64 GetFileAttributesA FreeLibrary GetCurrentThreadId MultiByteToWideChar GetTempPathA ReadFile GetVolumeInformationW GetLogicalDrives FindFirstFileA DeviceIoControl FindNextFileA CreateFileA FileTimeToSystemTime LoadLibraryA GetWindowsDirectoryA GetFileSize GlobalMemoryStatusEx GetDriveTypeW SystemTimeToTzSpecificLocalTime QueryDosDeviceW CompareFileTime MoveFileA GetFileSizeEx HeapFree GetLongPathNameW ExpandEnvironmentStringsA GetSystemDirectoryW GetCurrentDirectoryA GetLogicalDriveStringsW CopyFileA MoveFileExA GetSystemDirectoryA DeleteFileA HeapAlloc GetWindowsDirectoryW SetFilePointerEx LocalFree RemoveDirectoryA FindFirstStreamW GetProcessHeap SystemTimeToFileTime CopyFileW CreateProcessA GetSystemTimeAsFileTime CreateDirectoryA FindNextStreamW CompareStringOrdinal FindResourceA VirtualProtect GetEnvironmentVariableA GetModuleHandleExA GetCurrentThread RtlUnwind WaitForThreadpoolTimerCallbacks lstrcatA CancelWaitableTimer CloseThreadpoolTimer lstrcpyA SetThreadpoolTimer CreateThreadpoolTimer ExitProcess VirtualQuery GetDriveTypeA GetVolumeInformationA GetDiskFreeSpaceExA SetThreadPriority CreateThread GetFileAttributesExA CreateToolhelp32Snapshot Process32NextW Process32FirstW GetFileInformationByHandleEx MoveFileExW FlushFileBuffers PurgeComm GetCommState SetCommTimeouts SetCommState SetFileAttributesA GetComputerNameW QueryFullProcessImageNameW CreateEventW CancelIoEx GetOverlappedResult FindFirstFileExW GetSystemInfo OpenMutexA IsDebuggerPresent CheckRemoteDebuggerPresent GetModuleHandleA GetModuleFileNameA GetProcessWorkingSetSize VirtualUnlock VirtualLock SetProcessWorkingSetSize QueryPerformanceFrequency GetLocaleInfoEx GetLocaleInfoW IsValidLocale SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitOnceBeginInitialize GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP GetConsoleMode ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA InitOnceComplete MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime DeleteCriticalSection LockFileEx UnlockFile HeapDestroy HeapCompact RaiseException HeapReAlloc WaitForSingleObjectEx FlushViewOfFile GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate UnmapViewOfFile UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection LeaveCriticalSection LockFile GetDiskFreeSpaceW GetFullPathNameW EnterCriticalSection HeapCreate TryEnterCriticalSection AreFileApisANSI LoadLibraryExW OutputDebugStringW OutputDebugStringA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW LockResource SetProcessMitigationPolicy

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

comctl32

InitCommonControlsEx

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

crypt32

CertCloseStore CertOpenSystemStoreA CertGetCertificateContextProperty CertGetNameStringA CertEnumCertificatesInStore CertFreeCertificateContext CryptProtectData CryptUnprotectData

bcrypt

BCryptGenRandom BCryptHash

ole32

CoTaskMemFree CoTaskMemAlloc StgOpenStorage CoInitializeEx CoInitializeSecurity CoUninitialize CoSetProxyBlanket CoCreateInstance

oleaut32

VariantClear SysAllocString SysFreeString VariantInit VariantTimeToSystemTime

shell32

SHGetFileInfoW ExtractIconExW ord25 SHGetPathFromIDListW ord680 ShellExecuteW SHOpenFolderAndSelectItems ShellExecuteA SHGetFolderPathA SHParseDisplayName SHFileOperationW SHGetKnownFolderPath SHGetNameFromIDList SHGetFolderPathW ord18

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

dnsapi

DnsFree DnsQuery_A

Name

.text

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

232KB

Virtual Size

231KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_b43ea295e584386d21d587021313b4f2_amadey_glassworm_hellokitty_icedid_luca-stealer_njrat

PE Signature issue

setupapi

shlwapi

advapi32

user32

gdi32

kernel32

dwmapi

comctl32

d3d11

dxgi

crypt32

bcrypt

ole32

oleaut32

shell32

version

dnsapi

generic