2026-09-29_4bd321a4e70c147b3a7308910112a787_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_4bd321a4e70c147b3a7308910112a787_glassworm_icedid_luca-stealer_njrat_stealc
Size 4.9MB
Sample260930-b24tmssv7p
SHA256 0c15aba5e8f3731ad6c3352d25aa73935f33ad9072ae6faa79fbe985e9bc71ba
MD5 4bd321a4e70c147b3a7308910112a787
SHA1 58e424452bb4e8ca02c442c80c3c4688194db26d
SHA512 f8c2e29e7555c35c61fee6bd5313e0f5a4efcff1a05090b253b76ca3b8e4e8f3114f2e2e2202e2f2c066de3ae17a8c76f48ba6ae03bc44ddd8b4412f3806ec1a
SSDEEP 49152:22uPeiu9ryjkRDG7iD2dqEMGM8dwqbFr5eNO3eRQCv3thUHxtfU8Jl6njyWi3:Fuu1ywRDIBdoOeNZLhgtPf
TLSH
T103369D61A66C8B9DE036B039C1939617E7F1BC0D1321DFCBA6D08E770E1F5D0B66A219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_4bd321a4e70c147b3a7308910112a787_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-09-29_4bd321a4e70c147b3a7308910112a787_glassworm_icedid_luca-stealer_njrat_stealc

.exe 4.9MB

2026-09-29_4bd321a4e70c147b3a7308910112a787_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH fe2b10271322c15f871ff31c1811d594
SHA256 0c15aba5e8f3731ad6c3352d25aa73935f33ad9072ae6faa79fbe985e9bc71ba
MD5 4bd321a4e70c147b3a7308910112a787
SHA1 58e424452bb4e8ca02c442c80c3c4688194db26d
SHA512 f8c2e29e7555c35c61fee6bd5313e0f5a4efcff1a05090b253b76ca3b8e4e8f3114f2e2e2202e2f2c066de3ae17a8c76f48ba6ae03bc44ddd8b4412f3806ec1a
SSDEEP 49152:22uPeiu9ryjkRDG7iD2dqEMGM8dwqbFr5eNO3eRQCv3thUHxtfU8Jl6njyWi3:Fuu1ywRDIBdoOeNZLhgtPf
TLSH
T103369D61A66C8B9DE036B039C1939617E7F1BC0D1321DFCBA6D08E770E1F5D0B66A219
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing combination of virtualization drivers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4069268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e:\DELETE HEX PANEL\Actual Project\bin\Imgui Raid.pdb

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dcomp

DCompositionCreateDevice

dwmapi

DwmGetWindowAttribute

shell32

CommandLineToArgvW ShellExecuteA

wininet

InternetCloseHandle InternetReadFile InternetOpenA HttpQueryInfoA InternetOpenUrlA

bcrypt

BCryptHashData BCryptDestroyKey BCryptDecrypt BCryptEncrypt BCryptCreateHash BCryptSetProperty BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDestroyHash

winhttp

WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpConnect

crypt32

CryptStringToBinaryA CryptBinaryToStringA

kernel32

FindFirstFileExW FindClose FlushFileBuffers GetConsoleOutputCP ReadConsoleW GetConsoleMode SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetTimeZoneInformation GetFileType SetStdHandle CreateFileW SetEndOfFile Sleep GetTickCount64 WideCharToMultiByte WriteProcessMemory WaitForSingleObject CloseHandle GetProcAddress ReadProcessMemory GetModuleHandleW VirtualQueryEx GetCurrentProcess ExpandEnvironmentStringsA GetModuleHandleA OpenProcess GetCurrentThread AddVectoredExceptionHandler GetCurrentProcessId QueryFullProcessImageNameW GetTickCount CreateDirectoryW GetModuleFileNameW GetLocalTime GetEnvironmentVariableA GetFileAttributesW MultiByteToWideChar GetThreadContext GetWindowsDirectoryW ExitProcess IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent CreateToolhelp32Snapshot Process32NextW Process32FirstW GetLastError CreateThread SetThreadPriority SwitchToThread OutputDebugStringA GetSystemInfo VirtualProtectEx Beep GetTempPathA SetFileAttributesA CreateDirectoryA GetVolumeInformationA GetCommandLineW IsValidCodePage GetTempPathW GetFileAttributesExW DeleteFileW TlsFree WriteConsoleW UnhandledExceptionFilter CopyFileW LoadLibraryW FreeLibrary GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency VerSetConditionMask QueryPerformanceCounter CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA FreeLibraryAndExitThread GetStringTypeW GetSystemTimeAsFileTime HeapSize LCMapStringEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection DecodePointer EncodePointer InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RaiseException WakeAllConditionVariable GetExitCodeThread WaitForSingleObjectEx GetCurrentThreadId SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive FindNextFileW GetACP GetOEMCP GetEnvironmentVariableW GetCPInfo InitializeSListHead GetStartupInfoW RtlUnwindEx SetLastError RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue GetCommandLineA SetUnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW CreateProcessW SetEnvironmentVariableW MoveFileExW ExitThread LocalFree TerminateProcess WriteFile GetStdHandle LoadLibraryExW

user32

GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData MessageBoxW MessageBeep GetWindow EnumChildWindows GetClassNameA GetWindowTextA MapWindowPoints MoveWindow EnumWindows SetLayeredWindowAttributes LoadCursorW FindWindowA GetMessageExtraInfo ScreenToClient GetWindowLongPtrW IsChild GetCursorPos GetClientRect SetWindowRgn PostQuitMessage GetWindowThreadProcessId PostMessageW GetWindowRect DestroyWindow IsWindowVisible SetWindowPos SetWindowLongPtrW CreateWindowExW GetSystemMetrics RegisterClassExW WindowFromPoint ShowWindow IsWindow GetAsyncKeyState DispatchMessageW RedrawWindow PeekMessageW TranslateMessage GetClassNameW GetParent UpdateWindow SetForegroundWindow IsIconic GetWindowTextW GetKeyState DefWindowProcW UnregisterClassW

gdi32

DeleteObject CreateSolidBrush CreateRectRgn

advapi32

GetUserNameA RegOpenKeyExW RegQueryValueExW RegCloseKey

ole32

CoInitializeEx CoSetProxyBlanket CoCreateInstance CoUninitialize

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

dbghelp

SymGetModuleBase64 SymSetOptions StackWalk64 SymInitialize SymCleanup SymFromAddr SymFunctionTableAccess64

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlPcToFileHeader RtlVirtualUnwind

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

427KB

Virtual Size

426KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

259KB

Virtual Size

312KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_4bd321a4e70c147b3a7308910112a787_glassworm_icedid_luca-stealer_njrat_stealc

d3d11

d3dcompiler_47

dcomp

dwmapi

shell32

wininet

bcrypt

winhttp

crypt32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

dbghelp

ntdll

imm32

generic