2026-09-28_56cd0ffd403eb8585ce1d67cb692d270_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_56cd0ffd403eb8585ce1d67cb692d270_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc
Size 10.5MB
Sample260928-s5dkasysft
SHA256 7d1989b596a01963a4c7eacc0459933542716898eaf16529d435081c074ae937
MD5 56cd0ffd403eb8585ce1d67cb692d270
SHA1 f926461ecbd1500600bfc4049551b9db27883ad0
SHA512 f1ac35ccf0eec3e622dcc8249980196499f2e80d4ac7f5461142db76c6519f14cdd39e3023e3c068190767a831bf2725c67c9002d46bb14f6b9be89609ccf86c
SSDEEP 98304:rX4mpar9kZjnjNoSLpfGzovoimpXLSEP8Yfj07G5hS7HG/ShGl0TJo0A80Kd4+Vp:r1parSRmIyfj0iYu0g6R7fR6e
TLSH
T187B67C27E6B540B9D4AFC1718787A332BA30B8481234B69F1954C7A13F26EA067FF754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_56cd0ffd403eb8585ce1d67cb692d270_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc

File Explorer

2026-09-28_56cd0ffd403eb8585ce1d67cb692d270_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc

.exe 10.5MB

2026-09-28_56cd0ffd403eb8585ce1d67cb692d270_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc

IMPHASH 93ffacfc2dee87d928f7d1ece3c0afc2
SHA256 7d1989b596a01963a4c7eacc0459933542716898eaf16529d435081c074ae937
MD5 56cd0ffd403eb8585ce1d67cb692d270
SHA1 f926461ecbd1500600bfc4049551b9db27883ad0
SHA512 f1ac35ccf0eec3e622dcc8249980196499f2e80d4ac7f5461142db76c6519f14cdd39e3023e3c068190767a831bf2725c67c9002d46bb14f6b9be89609ccf86c
SSDEEP 98304:rX4mpar9kZjnjNoSLpfGzovoimpXLSEP8Yfj07G5hS7HG/ShGl0TJo0A80Kd4+Vp:r1parSRmIyfj0iYu0g6R7fR6e
TLSH
T187B67C27E6B540B9D4AFC1718787A332BA30B8481234B69F1954C7A13F26EA067FF754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2235844

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Mouzer\Desktop\BHSv2\x64\Release\BHSv2.pdb

kernel32

GetCurrentThread TerminateThread LoadLibraryA LockResource QueryPerformanceFrequency DeleteFileA DeleteFileW Process32FirstW CloseHandle GetNativeSystemInfo GetSystemInfo LoadLibraryW CreateThread LoadResource FindResourceW HeapAlloc GetCurrentDirectoryW DecodePointer GetThreadContext GetWindowsDirectoryW GetProcAddress GlobalLock VirtualAllocEx LocalFree GetFileSize DeleteCriticalSection ExitProcess ReadProcessMemory GetCurrentProcessId GetProcessHeap GlobalMemoryStatusEx CreateProcessW GetModuleHandleW FreeLibrary CopyFileW WideCharToMultiByte WinExec CreateRemoteThread CreateFileMappingW MapViewOfFile SetThreadContext QueryPerformanceCounter GetTickCount GlobalUnlock ConnectNamedPipe GetComputerNameA CheckRemoteDebuggerPresent FlushFileBuffers AreFileApisANSI TryEnterCriticalSection HeapCreate EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA UnlockFileEx CreateMutexW GetCurrentThreadId HeapValidate HeapSize FormatMessageW GetDiskFreeSpaceA OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx HeapReAlloc RaiseException HeapCompact HeapDestroy UnlockFile LockFileEx SetEvent GetSystemTimeAsFileTime GetSystemTime FormatMessageA WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP GetFileType SetFilePointerEx GetStdHandle FreeLibraryAndExitThread ExitThread GetModuleHandleExW GlobalSize SetFileInformationByHandle Process32NextW GetFileAttributesExW GetFileAttributesA GetLastError GetTickCount64 GetTimeZoneInformation GetTempPathA Sleep MultiByteToWideChar CreateEventW CreateToolhelp32Snapshot OpenProcess DisconnectNamedPipe GetModuleHandleA UnmapViewOfFile ResumeThread GetFileAttributesW CreateFileW WaitForSingleObject FindClose InitializeCriticalSectionEx GetTempPathW PeekNamedPipe SetEndOfFile GetEnvironmentVariableW SetFilePointer FindNextFileA RtlAddFunctionTable GetUserDefaultLocaleName CreateNamedPipeW GetModuleFileNameW GetDriveTypeA RemoveDirectoryW TerminateProcess VirtualAlloc WriteFile GetCurrentProcess FindNextFileW GetCommandLineW VirtualFree CreateDirectoryW HeapFree VirtualProtect FindFirstFileA WriteProcessMemory LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext IsDebuggerPresent GetStringTypeW GetCPInfo CompareStringEx EncodePointer GetFileSizeEx FindFirstFileW LCMapStringEx WakeAllConditionVariable GetLogicalDrives QueryDosDeviceW SizeofResource ReadFile SystemTimeToFileTime SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLocaleInfoEx GetExitCodeThread CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW DeviceIoControl GetFinalPathNameByHandleW GetFileInformationByHandle FindFirstFileExW RtlUnwind

user32

FindWindowA GetCursorPos GetWindowThreadProcessId IsWindowVisible SetWindowPos SetWindowLongPtrW SendMessageW GetSystemMetrics GetDC DestroyWindow ReleaseDC EnumWindows SystemParametersInfoW GetDesktopWindow wsprintfW GetClassNameW GetClipboardData TranslateMessage SetLayeredWindowAttributes GetWindowLongPtrW MessageBoxA GetKeyboardLayout PeekMessageW CloseClipboard DispatchMessageW OpenClipboard IsWindow ShowWindow PostMessageW

gdi32

GetObjectW GetEnhMetaFileBits BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDIBits DeleteDC DeleteObject

advapi32

RegQueryInfoKeyW GetTokenInformation RegEnumKeyExA RegQueryValueExW RegEnumValueW AddAccessAllowedAce GetLengthSid LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey CredEnumerateW CloseServiceHandle RegQueryValueExA OpenSCManagerW RegDeleteKeyW SetEntriesInAclW CredFree CreateWellKnownSid GetUserNameA RegCreateKeyExW ControlService RegEnumKeyExW RegSetValueExW OpenProcessToken RegOpenKeyExA InitializeAcl RegOpenKeyExW SetSecurityInfo RegEnumValueA ChangeServiceConfigW RegDeleteValueW OpenServiceW

shell32

SHGetFolderPathW CommandLineToArgvW ShellExecuteW DragQueryFileW

ole32

CoCreateInstance CoGetObject StringFromGUID2 CoSetProxyBlanket CLSIDFromString CoInitializeSecurity CoInitializeEx CoUninitialize CoInitialize CoCreateGuid

oleaut32

VariantClear SafeArrayCreateVector LoadTypeLibEx SafeArrayCreate SafeArrayLock SafeArrayPutElement SysAllocString SysAllocStringByteLen SysStringByteLen SysFreeString SafeArrayGetLBound SafeArrayUnlock SafeArrayGetUBound VariantInit SafeArrayDestroy

avicap32

capCreateCaptureWindowW

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptDestroyKey BCryptGenRandom BCryptOpenAlgorithmProvider

crypt32

CryptUnprotectData CryptStringToBinaryA

iphlpapi

GetAdaptersInfo

gdiplus

GdiplusStartup GdiplusShutdown GdipCloneImage GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipSaveImageToFile

ws2_32

freeaddrinfo inet_ntop gethostname getaddrinfo

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest

mscoree

CLRCreateInstance

dwmapi

DwmSetWindowAttribute

ntdll

NtCreateSection NtQuerySystemInformation NtReadFile NtDuplicateObject NtQueryInformationFile NtQueryObject NtMapViewOfSection NtOpenProcess

wtsapi32

WTSQuerySessionInformationA WTSEnumerateSessionsA WTSFreeMemory

wlanapi

WlanEnumInterfaces WlanOpenHandle WlanGetProfile WlanGetProfileList WlanCloseHandle WlanFreeMemory

powrprof

PowerReadFriendlyName PowerGetActiveScheme

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8.0MB

Virtual Size

8.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_56cd0ffd403eb8585ce1d67cb692d270_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

avicap32

bcrypt

crypt32

iphlpapi

gdiplus

ws2_32

winhttp

mscoree

dwmapi

ntdll

wtsapi32

wlanapi

powrprof

generic