2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat
Size 4.2MB
Sample260930-ck4yracd47
SHA256 40080b79d10c25c082e71c817a0ef0fd6e21070ba68d58f380cd763578eb6ed6
MD5 459b78a8dcdbedbd0e460c65dff40c33
SHA1 2086caaade7d4cb3b7bfd8cf90ca671c622937a7
SHA512 4cd8031400e7167213ee2e2f6133add07cc8e307a1af2ceea01f1cbeff9328b5d6e8ab88ff4326a3a606eacb1d09cb211f9013bec5113235860831b8d7fc4514
SSDEEP 49152:JaXZuzzO4cg/qNB+6+6h/Lka8IseawMrOKa259H+hxSMmT8oWgBCaXRyMRYmJzxD:jpjXEseanLe+M4FHXYYbJzl8l+M4FHX
TLSH
T1D526D06EAE9902ECD477C178C9524507EBB27C0543616ADF0EA07676EF37AE05A3E301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat

File Explorer

2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat

.exe 4.2MB

2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat

IMPHASH 67ea259b41e7a68ac4ed27e78a1e2019
SHA256 40080b79d10c25c082e71c817a0ef0fd6e21070ba68d58f380cd763578eb6ed6
MD5 459b78a8dcdbedbd0e460c65dff40c33
SHA1 2086caaade7d4cb3b7bfd8cf90ca671c622937a7
SHA512 4cd8031400e7167213ee2e2f6133add07cc8e307a1af2ceea01f1cbeff9328b5d6e8ab88ff4326a3a606eacb1d09cb211f9013bec5113235860831b8d7fc4514
SSDEEP 49152:JaXZuzzO4cg/qNB+6+6h/Lka8IseawMrOKa259H+hxSMmT8oWgBCaXRyMRYmJzxD:jpjXEseanLe+M4FHXYYbJzl8l+M4FHX
TLSH
T1D526D06EAE9902ECD477C178C9524507EBB27C0543616ADF0EA07676EF37AE05A3E301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1547392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SubmitTelem.pdb

shell32

SHGetKnownFolderPath SHGetFolderPathW CommandLineToArgvW

kernel32

GetCommandLineW LocalFree FindFirstFileW SetLastError FindNextFileW FindClose MultiByteToWideChar InitializeSRWLock WakeConditionVariable InitializeConditionVariable ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetModuleHandleA VirtualAlloc GetSystemInfo Sleep GetCurrentThreadId GetLogicalProcessorInformation FreeLibrary LoadLibraryExW ReadFile CreateFileW ExpandEnvironmentStringsW SetEvent GlobalFree QueryPerformanceFrequency GetFileSize WaitForSingleObject WriteFile GetConsoleMode OutputDebugStringA GetFileInformationByHandleEx DeviceIoControl SetFilePointer SetEndOfFile GetFileInformationByHandle MoveFileExW ReplaceFileW FlushFileBuffers GetModuleFileNameW GetFileAttributesW GetStdHandle FileTimeToSystemTime FreeEnvironmentStringsW CreateEventW FormatMessageW RaiseException VirtualProtect VirtualQuery IsValidCodePage SetDllDirectoryW GetModuleHandleW GetProcAddress HeapSetInformation SetSearchPathMode GetEnvironmentVariableW SetEnvironmentVariableW LoadLibraryExA OpenProcess GetCurrentProcessId OutputDebugStringW TerminateProcess GetCurrentProcess GetPrivateProfileStringW GetPrivateProfileSectionNamesW WideCharToMultiByte GetProcessHeap HeapAlloc HeapReAlloc HeapSize HeapFree DeleteCriticalSection DecodePointer GetLastError RtlUnwind InitializeCriticalSectionEx CloseHandle GetACP GetOEMCP GetEnvironmentStringsW WriteConsoleW SetStdHandle SetFilePointerEx GetFileSizeEx GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineA FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess GetConsoleOutputCP WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW FormatMessageA TryAcquireSRWLockExclusive WaitForSingleObjectEx SwitchToThread GetExitCodeThread RtlPcToFileHeader GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW GetTempPathW AreFileApisANSI GetStringTypeW ReleaseSRWLockShared AcquireSRWLockShared EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx CompareStringEx GetCPInfo RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetFileType ReadConsoleW

advapi32

RegDeleteKeyExW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegSetKeySecurity RegDeleteTreeW RegCopyTreeW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW ConvertSidToStringSidA IsWellKnownSid OpenProcessToken GetTokenInformation CryptDestroyKey CryptAcquireContextW CryptDecrypt CryptCreateHash CryptHashData CryptDestroyHash CryptSetKeyParam CryptImportKey CryptGetHashParam CryptReleaseContext

ole32

CoTaskMemFree

bcrypt

BCryptGetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDeriveKeyPBKDF2 BCryptCreateHash BCryptFinishHash BCryptDestroyHash BCryptHashData

winhttp

WinHttpOpenRequest WinHttpSetOption WinHttpQueryAuthSchemes WinHttpWriteData WinHttpSendRequest WinHttpAddRequestHeaders WinHttpSetStatusCallback WinHttpQueryOption WinHttpConnect WinHttpGetDefaultProxyConfiguration WinHttpOpen WinHttpGetProxyForUrl WinHttpReceiveResponse WinHttpCloseHandle WinHttpQueryHeaders WinHttpSetCredentials

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

483KB

Virtual Size

483KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_459b78a8dcdbedbd0e460c65dff40c33_glassworm_icedid_luca-stealer_njrat

shell32

kernel32

advapi32

ole32

bcrypt

winhttp

generic