2026-09-29_d8aa3ab77381a17befa120022ed5c155_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_d8aa3ab77381a17befa120022ed5c155_glassworm_icedid_luca-stealer_njrat_stealc
Size 3.7MB
Sample260929-s2y2tsvbqf
SHA256 39deb0c36dc98f9dba598899e844813b278b2594ae9fd5e4062a5c13c59dede8
MD5 d8aa3ab77381a17befa120022ed5c155
SHA1 41a55d87042307c414df52d668253948e4431aea
SHA512 b907bebcba67d047893633bc1f141f0b9a9330044da1a821e6bb3c334c7e6b162e0b913749e4ed440ba94142b644c70b4c9136f798bd4f65aa7dbaf57c14e2c2
SSDEEP 98304:NT7saY6RWr5Fthq+Hmr6dABm8EzmBmhzA2ZpXGP:tfY6RWr5Fthq+HHdRFmBmhzA2ZpXG
TLSH
T15806AE4AB3B801B8D17BC138CA56960BE7B17455136097CF13E08AB96FA3BE15B3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_d8aa3ab77381a17befa120022ed5c155_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-29_d8aa3ab77381a17befa120022ed5c155_glassworm_icedid_luca-stealer_njrat_stealc

.exe 3.7MB

2026-09-29_d8aa3ab77381a17befa120022ed5c155_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 18af993aebf153c9b36ac03e557309b7
SHA256 39deb0c36dc98f9dba598899e844813b278b2594ae9fd5e4062a5c13c59dede8
MD5 d8aa3ab77381a17befa120022ed5c155
SHA1 41a55d87042307c414df52d668253948e4431aea
SHA512 b907bebcba67d047893633bc1f141f0b9a9330044da1a821e6bb3c334c7e6b162e0b913749e4ed440ba94142b644c70b4c9136f798bd4f65aa7dbaf57c14e2c2
SSDEEP 98304:NT7saY6RWr5Fthq+Hmr6dABm8EzmBmhzA2ZpXGP:tfY6RWr5Fthq+HHdRFmBmhzA2ZpXG
TLSH
T15806AE4AB3B801B8D17BC138CA56960BE7B17455136097CF13E08AB96FA3BE15B3E351
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3776512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

ws2_32

WSACreateEvent send getsockopt WSASetLastError WSAEnumNetworkEvents gethostname WSAEventSelect ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl select __WSAFDIsSet WSAIoctl WSAResetEvent setsockopt recv getsockname getpeername connect bind accept WSACleanup WSAStartup ntohs socket htons WSAGetLastError closesocket WSAWaitForMultipleEvents WSACloseEvent

iphlpapi

if_nametoindex

crypt32

CryptStringToBinaryW CertFreeCertificateContext CertOpenStore CertCloseStore CertFindCertificateInStore PFXImportCertStore CryptDecodeObjectEx CertFreeCRLContext CertAddCertificateContextToStore CertEnumCertificatesInStore CertFreeCTLContext CertFindExtension CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW

secur32

InitSecurityInterfaceW

wininet

InternetCloseHandle InternetReadFile HttpQueryInfoA InternetOpenA HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenUrlA InternetSetOptionA

kernel32

GetTimeFormatW HeapAlloc WriteConsoleW InitializeSListHead SetFilePointerEx GetConsoleOutputCP CompareStringW LCMapStringW GetDateFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetExitCodeProcess CreateProcessW GetFileAttributesExW HeapReAlloc ReadConsoleW GetLocaleInfoW GetTimeZoneInformation GetCurrentProcessId GetConsoleMode FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree GetCurrentProcess TerminateProcess GetModuleHandleA CreateToolhelp32Snapshot Process32NextW GetCurrentThread Process32FirstW CloseHandle GetThreadContext GetProcAddress ExitProcess GetModuleHandleW IsDebuggerPresent CheckRemoteDebuggerPresent CreateDirectoryW ReadFile GetVolumeInformationW GetFileSizeEx WriteProcessMemory WriteFile GetModuleFileNameW GetEnvironmentVariableW GetTempPathW WaitForSingleObject CreateFileW OpenProcess GetExitCodeThread GetLastError DeleteFileW GetSystemInfo VirtualAllocEx GetComputerNameW CreateRemoteThread FlushFileBuffers GetTickCount IsWow64Process GetFileAttributesW RemoveVectoredExceptionHandler GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte VerSetConditionMask FreeLibrary QueryPerformanceCounter OutputDebugStringA GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx Sleep SetLastError GetFullPathNameW MoveFileExW WaitForSingleObjectEx CreateThread GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW FormatMessageW LocalFree GetTickCount64 GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer GetSystemTimeAsFileTime WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RaiseException RtlPcToFileHeader TlsSetValue SetStdHandle SetEndOfFile HeapFree GetCurrentDirectoryW OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize VirtualFreeEx RtlUnwind TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetCurrentThreadId TryAcquireSRWLockExclusive SleepConditionVariableSRW RtlUnwindEx

user32

SetClipboardData GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture CloseClipboard GetClipboardData GetWindowRect SetWindowPos GetCursorPos DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW EnumWindows SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow GetWindowTextW OpenClipboard EmptyClipboard SetCursorPos

advapi32

CryptImportKey CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptEncrypt CryptAcquireContextW

shell32

ShellExecuteW

d3dcompiler_47

D3DCompile

imm32

ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow ImmGetContext

bcrypt

BCryptGenRandom

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

735KB

Virtual Size

734KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd003

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_d8aa3ab77381a17befa120022ed5c155_glassworm_icedid_luca-stealer_njrat_stealc

d3d11

dwmapi

ws2_32

iphlpapi

crypt32

secur32

wininet

kernel32

user32

advapi32

shell32

d3dcompiler_47

imm32

bcrypt

generic