2026-09-29_cc7bca5466cbcd7afed80e794d2cf429_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_cc7bca5466cbcd7afed80e794d2cf429_glassworm_icedid_luca-stealer_njrat_stealc
Size 5.9MB
Sample260929-tx9hfayzhy
SHA256 9c9b8125a0e7e941ff77ed6e5ce366bc74795cac71d1fc30aebc45f028df0773
MD5 cc7bca5466cbcd7afed80e794d2cf429
SHA1 ab695fcde7f5cf0c8d10f977ffd3d89821598e4f
SHA512 328c786d7b814efc2150be119ca19e7830ab09796cfa980b1dd4a8478a3ea2a54d3dce3e46b9443f8f1d6b7e0fb4e0580a36582cb9c364ab639933a8f5349851
SSDEEP 49152:ZLo9pMoR6Azs5/SFuT6ijm28LfGjAM1gvmnNNTCv5EEWvjlnwq38kAVdCfGWjNwx:8iS4XyOUIo3l1Z/CnZZyOZUq1wvRuj0x
TLSH
T1A3565A16A3F842D9F0F7EB359E764113DA73BC465A35C69F0290955A0E37A209E38B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-29_cc7bca5466cbcd7afed80e794d2cf429_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-29_cc7bca5466cbcd7afed80e794d2cf429_glassworm_icedid_luca-stealer_njrat_stealc

.exe 5.9MB

2026-09-29_cc7bca5466cbcd7afed80e794d2cf429_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 376b91c4a48ee8f1512c2474622d818f
SHA256 9c9b8125a0e7e941ff77ed6e5ce366bc74795cac71d1fc30aebc45f028df0773
MD5 cc7bca5466cbcd7afed80e794d2cf429
SHA1 ab695fcde7f5cf0c8d10f977ffd3d89821598e4f
SHA512 328c786d7b814efc2150be119ca19e7830ab09796cfa980b1dd4a8478a3ea2a54d3dce3e46b9443f8f1d6b7e0fb4e0580a36582cb9c364ab639933a8f5349851
SSDEEP 49152:ZLo9pMoR6Azs5/SFuT6ijm28LfGjAM1gvmnNNTCv5EEWvjlnwq38kAVdCfGWjNwx:8iS4XyOUIo3l1Z/CnZZyOZUq1wvRuj0x
TLSH
T1A3565A16A3F842D9F0F7EB359E764113DA73BC465A35C69F0290955A0E37A209E38B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

02:29:1e:4c:ed:1a:01:c5:fa:10:c7:fc:03:17:7f:dc:2d:50:f3:95:20:51:c7:0f:92:e2:e4:a5:e7:96:7d:7a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=CoreX,O=YunXiao,1.2.840.113549.1.9.1=#0c103731373935333734364071712e636f6d

Chains

Sep 26, 2026

CN=CoreX,O=YunXiao,1.2.840.113549.1.9.1=#0c103731373935333734364071712e636f6d

Subject

CN=CoreX,O=YunXiao,1.2.840.113549.1.9.1=#0c103731373935333734364071712e636f6d

Serial Number

22:8f:3b:4c:b3:33:6d:aa:44:5c:b6:fa:b5:9a:f2:6a

Issuer

CN=CoreX,O=YunXiao,1.2.840.113549.1.9.1=#0c103731373935333734364071712e636f6d

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2026 - Feb 11, 2031

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2799952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\CoreX-build-artifacts\publish-093-20260926\candidate\x64\Release\CoreX.pdb

kernel32

SetInformationJobObject AssignProcessToJobObject CreateNamedPipeW CreateJobObjectW GetNamedPipeClientProcessId ResumeThread CreateEventW CancelIoEx ResetEvent GetOverlappedResult ConnectNamedPipe K32EnumProcessModulesEx K32GetModuleBaseNameW Module32FirstW Module32NextW K32GetModuleFileNameExW GetStdHandle WriteConsoleW MoveFileW SetProcessPriorityBoost SetThreadAffinityMask GetProcessWorkingSetSizeEx QueryInformationJobObject SetThreadInformation SetPriorityClass SetProcessInformation GetProcessId DuplicateHandle K32GetProcessMemoryInfo SetProcessWorkingSetSizeEx SetThreadPriorityBoost GetProcessInformation GetProcessPriorityBoost GetWindowsDirectoryW GetSystemInfo GetEnvironmentVariableW QueryThreadCycleTime K32EnumProcessModules SetNamedPipeHandleState WaitForMultipleObjects DisconnectNamedPipe SetEvent WaitNamedPipeW GetCurrentProcessorNumberEx GetLogicalProcessorInformationEx SetSystemFileCacheSize K32EmptyWorkingSet GetLogicalDriveStringsW K32EnumProcesses GlobalMemoryStatusEx QueryDosDeviceW GetThreadPriorityBoost GetThreadDescription SetThreadIdealProcessor K32GetMappedFileNameW GetThreadInformation VirtualQueryEx SwitchToThread SuspendThread GetUserDefaultUILanguage GetUserPreferredUILanguages LCIDToLocaleName LocaleNameToLCID GetComputerNameW SetFilePointer SizeofResource LockResource LoadResource FindResourceW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW GetLocalTime GetACP IsValidCodePage FindFirstFileExW GetConsoleMode GetConsoleOutputCP SetFilePointerEx HeapReAlloc GetTimeZoneInformation GetFileType HeapAlloc HeapFree EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleHandleExW FreeLibraryAndExitThread ExitThread VirtualAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetSystemTimeAsFileTime InitializeCriticalSectionEx InitOnceBeginInitialize InitOnceComplete TryAcquireSRWLockShared AcquireSRWLockShared ReleaseSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetStringTypeW RaiseException RtlPcToFileHeader SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable WaitForSingleObjectEx WTSGetActiveConsoleSessionId GetCommandLineA SetFileInformationByHandle GetPrivateProfileStringW GetPrivateProfileSectionNamesW GetPrivateProfileIntW GetActiveProcessorCount GetActiveProcessorGroupCount GetThreadGroupAffinity GetSystemCpuSetInformation GetThreadIdealProcessorEx GetProcessIdOfThread GetExitCodeThread GetThreadPriority SetThreadGroupAffinity GetThreadTimes Thread32First Thread32Next FormatMessageW LocalAlloc VirtualQuery GetFileSize CheckRemoteDebuggerPresent IsDebuggerPresent GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW GetThreadContext CreateThread K32GetModuleInformation QueryPerformanceFrequency UnmapViewOfFile GetSystemDirectoryW FindClose VirtualProtect FindFirstFileW GetDriveTypeW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SearchPathW QueueUserWorkItem GetPriorityClass CompareFileTime GetCurrentThreadId lstrcmpiW CopyFileW LoadLibraryExW CreateProcessW GetProcAddress MulDiv GetModuleHandleW GetExitCodeProcess FlushFileBuffers OpenThread GetProcessTimes SetProcessWorkingSetSize GetThreadSelectedCpuSets WideCharToMultiByte GetCurrentThread ProcessIdToSessionId SetProcessDefaultCpuSets GetPrivateProfileSectionW GetProcessDefaultCpuSets SetThreadPriority GetSystemTimes GetProcessAffinityMask TerminateProcess SetProcessAffinityMask SetLastError WritePrivateProfileStringW GetFileSizeEx SetThreadIdealProcessorEx SetThreadSelectedCpuSets CreateDirectoryW SetUnhandledExceptionFilter GlobalUnlock OpenMutexW QueryFullProcessImageNameW FreeLibrary GetCurrentProcessId ExitProcess MoveFileExW LocalFree GlobalLock LoadLibraryW CloseHandle GlobalFree Process32FirstW DeleteFileW GetFileInformationByHandleEx GlobalAlloc Process32NextW GetLastError GetTickCount64 Sleep MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess ReleaseMutex GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW GetModuleFileNameW ExpandEnvironmentStringsW WriteFile GetCurrentProcess GetCommandLineW SetDefaultDllDirectories ReadFile GetOEMCP

user32

DestroyWindow SendMessageTimeoutW SetProcessDpiAwarenessContext GetWindow PostMessageW DefWindowProcW GetMessageW GetWindowThreadProcessId IsIconic UpdateWindow KillTimer BringWindowToTop SetFocus SetActiveWindow SetWindowPos EndPaint MessageBoxW SetWindowLongPtrW CreateWindowExW SendMessageW CreatePopupMenu GetWindowLongPtrW TrackPopupMenu ShowWindow IsWindow DispatchMessageW GetCursorPos wsprintfW ValidateRect GetWindowTextLengthW EndDialog SetDlgItemTextW FrameRect GetDlgItemTextW SendDlgItemMessageW GetDlgItemInt DialogBoxParamW EnumDisplaySettingsW AllowSetForegroundWindow MsgWaitForMultipleObjects MsgWaitForMultipleObjectsEx MessageBoxIndirectW GetShellWindow GetClassNameA GetWindowDC UnionRect GetForegroundWindow GetMessageTime ChangeWindowMessageFilterEx SetLayeredWindowAttributes SetScrollInfo GetMenuItemCount GetScrollInfo GetCapture DrawFocusRect IsRectEmpty GetSystemMetricsForDpi GetSysColorBrush GetWindowRgn WindowFromPoint ClientToScreen DefDlgProcW SetTimer ScrollWindowEx SetCapture GetAncestor WaitMessage PeekMessageW IsWindowEnabled ReleaseCapture MonitorFromPoint MonitorFromWindow IsDialogMessageW GetDlgItem GetDesktopWindow BeginPaint ReleaseDC InvalidateRect GetDpiForSystem LoadImageW PtInRect DrawTextW GetClientRect SetCursor SetClipboardData RegisterClassW EnumWindows DestroyMenu TranslateMessage LoadIconW FindWindowW EndDeferWindowPos LoadCursorW MapWindowPoints EmptyClipboard CloseClipboard GetMonitorInfoW DestroyIcon RedrawWindow OffsetRect OpenClipboard BeginDeferWindowPos RegisterClassExW GetSystemMetrics ScreenToClient FillRect EnumChildWindows MonitorFromRect GetDpiForWindow GetDC InflateRect GetWindowRect DeferWindowPos SetRectEmpty GetParent SystemParametersInfoW GetComboBoxInfo SetWindowLongW SetPropW RemovePropW GetPropW ShowScrollBar GetWindowLongW EnableWindow GetWindowPlacement SetWindowTextW GetMessagePos MoveWindow SetWindowRgn SetForegroundWindow GetWindowTextW CharLowerBuffW DrawIconEx EnableMenuItem CheckMenuItem TrackPopupMenuEx SetWindowsHookExW EndMenu UnhookWindowsHookEx RegisterWindowMessageW PostQuitMessage PostThreadMessageW IsWindowVisible GetClassNameW AppendMenuW SetMenuInfo CallNextHookEx InsertMenuItemW CheckMenuRadioItem TrackMouseEvent GetDlgCtrlID GetFocus GetKeyState IsChild

gdi32

BitBlt RestoreDC SaveDC CreateCompatibleDC CreateCompatibleBitmap Ellipse CreateFontIndirectW Rectangle SelectObject GetRgnBox CreateBitmap ExcludeClipRect ExtCreatePen CreateRectRgn SelectClipRgn GetClipRgn Polygon CreateRoundRectRgn CreateFontW GetStockObject GetDeviceCaps DeleteDC GetTextExtentPoint32W SetTextColor SetBkMode LineTo CreatePen GetObjectW MoveToEx SetBkColor DeleteObject CreateSolidBrush IntersectClipRect RoundRect GetTextMetricsW

shell32

ShellExecuteExW SHGetFileInfoW DragFinish DragQueryPoint DragQueryFileW SHCreateItemFromParsingName DragAcceptFiles Shell_NotifyIconW CommandLineToArgvW SHGetFolderPathW ExtractIconExW ShellExecuteW SHCreateDirectoryExW SHGetKnownFolderPath

ntdll

RtlGetVersion RtlNtStatusToDosError

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

uxtheme

SetWindowTheme

d2d1

ord1

dwrite

DWriteCreateFactory

winhttp

WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpAddRequestHeaders WinHttpSetTimeouts WinHttpSetStatusCallback WinHttpQueryOption WinHttpConnect WinHttpQueryDataAvailable WinHttpOpen WinHttpReceiveResponse WinHttpSendRequest WinHttpCrackUrl

crypt32

CertGetCertificateChain CertFreeCertificateContext CryptProtectData CertFreeCertificateChain CryptStringToBinaryA CryptBinaryToStringA CryptUnprotectData CertGetCertificateContextProperty CryptEncodeObject

bcrypt

BCryptVerifySignature BCryptGenerateSymmetricKey BCryptSecretAgreement BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptGenRandom BCryptGetProperty BCryptEncrypt BCryptDestroyKey BCryptFinalizeKeyPair BCryptDecrypt BCryptGenerateKeyPair BCryptExportKey BCryptDeriveKey BCryptDestroySecret BCryptImportKeyPair BCryptSetProperty

comdlg32

GetSaveFileNameW ChooseColorW GetOpenFileNameW

advapi32

OpenProcessToken RegCloseKey RegOpenCurrentUser CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid LookupPrivilegeValueW RegGetValueW RegDeleteValueW RegFlushKey RegisterServiceCtrlHandlerExW CreateServiceW SetServiceStatus ChangeServiceConfig2W SetEntriesInAclW RegCreateKeyExW RegQueryValueExW QueryServiceStatusEx OpenServiceW RegOpenKeyExW CheckTokenMembership FreeSid DeleteService ControlService IsValidSid ImpersonateNamedPipeClient StartServiceW SetSecurityInfo StartServiceCtrlDispatcherW QueryServiceConfigW ChangeServiceConfigW GetSecurityInfo TraceSetInformation StartTraceW ProcessTrace CloseTrace ControlTraceW OpenTraceW EnableTraceEx2 CreateProcessWithTokenW ConvertStringSecurityDescriptorToSecurityDescriptorW RevertToSelf EqualSid ConvertStringSidToSidW IsWellKnownSid ImpersonateLoggedOnUser ConvertSidToStringSidW DuplicateTokenEx OpenThreadToken LookupAccountSidW LookupAccountNameW GetTokenInformation RegSetValueExW AdjustTokenPrivileges

ole32

CoCreateInstance CreateStreamOnHGlobal CoInitializeEx CoTaskMemFree CoCreateGuid CoUninitialize CLSIDFromString CoSetProxyBlanket StringFromGUID2

oleaut32

VariantClear SysFreeString VariantInit VariantCopy SysAllocString

tdh

TdhGetProperty TdhGetEventInformation TdhGetPropertySize

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WinVerifyTrust

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

gdiplus

GdipAlloc GdipDisposeImage GdipFree GdipDeleteGraphics GdipCreateFromHDC GdipCreatePath GdipCreateStringFormat GdipSetInterpolationMode GdipDrawImageRect GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePen1 GdipDeletePen GdipCreateBitmapFromStream GdipLoadImageFromStream GdipTranslateWorldTransform GdipRestoreGraphics GdipRotateWorldTransform GdipDrawBezier GdipDrawImageRectI GdipSaveGraphics GdipAddPathLine GdipCloneImage GdipGetImageGraphicsContext GdipDrawArc GdipAddPathArc GdipCloneBrush GdipDrawEllipse GdipFillEllipse GdipDrawPath GdipClosePathFigure GdipSetPixelOffsetMode GdipDrawLine GdipFillPath GdipCreateSolidFill GdipSetPenLineCap197819 GdipSetSmoothingMode GdipDeletePath GdipDeleteBrush GdipAddPathRectangle GdipCreateLineBrushFromRect GdipSetStringFormatAlign GdipDeleteFont GdipDeleteStringFormat GdipDrawString GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipGraphicsClear GdipDrawRectangleI GdipCreateBitmapFromScan0 GdiplusStartup GdipCreateFontFamilyFromName GdiplusShutdown

shlwapi

PathMatchSpecW PathFileExistsW PathIsDirectoryW PathFindFileNameW PathRemoveExtensionW PathIsRelativeW PathRemoveFileSpecW

comctl32

ord412 ord410 InitCommonControlsEx ImageList_Add ImageList_Create ImageList_Destroy ord413

msimg32

GradientFill

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock GetUserProfileDirectoryW DestroyEnvironmentBlock

dbghelp

SymGetLineFromAddrW64 SymLoadModuleExW SymSetOptions SymCleanup SymGetOptions SymFromAddrW SymInitializeW

iphlpapi

GetAdaptersInfo

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

67KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_cc7bca5466cbcd7afed80e794d2cf429_glassworm_icedid_luca-stealer_njrat_stealc

PE Signature issue

kernel32

user32

gdi32

shell32

ntdll

dwmapi

uxtheme

d2d1

dwrite

winhttp

crypt32

bcrypt

comdlg32

advapi32

ole32

oleaut32

tdh

wintrust

version

gdiplus

shlwapi

comctl32

msimg32

wtsapi32

userenv

dbghelp

iphlpapi

generic