2026-09-30_2f268e410983699acce9e9cb18e68c47_glassworm_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_2f268e410983699acce9e9cb18e68c47_glassworm_icedid_luca-stealer_njrat
Size 4.5MB
Sample260930-ps72lavy2q
SHA256 b627b80bbf1f09e3c63ca840c6a998aad04dc3659bb2dc9de80492c2dfe98426
MD5 2f268e410983699acce9e9cb18e68c47
SHA1 c54117a7bf7dbd3e6bd93ad8766e9755eb6ea577
SHA512 2f37de34c8b91e7c89c9c44b47931b0b93e705afef5cec04dcea1e0814ac40d325898bfc178eee17260f35b73b3c54bc031a821ece96435ca0be675ea691f96b
SSDEEP 49152:iGQXCV4YakpAPRgsgSDIMrbUMXt4H4cDaqRuEX/B5hEGvPuhxSMmT8oWgBCaXwaa:czx95QDLuEvBm+M4FHXwJT6+M4FHX
TLSH
T1C626C01EAE9802ECD0B7C178C9565903EBB27C0543605ADF0EA46976DF7BAE05A3F701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_2f268e410983699acce9e9cb18e68c47_glassworm_icedid_luca-stealer_njrat

File Explorer

2026-09-30_2f268e410983699acce9e9cb18e68c47_glassworm_icedid_luca-stealer_njrat

.exe 4.5MB

2026-09-30_2f268e410983699acce9e9cb18e68c47_glassworm_icedid_luca-stealer_njrat

IMPHASH e05b9b858f964abd2b15f303d48a2926
SHA256 b627b80bbf1f09e3c63ca840c6a998aad04dc3659bb2dc9de80492c2dfe98426
MD5 2f268e410983699acce9e9cb18e68c47
SHA1 c54117a7bf7dbd3e6bd93ad8766e9755eb6ea577
SHA512 2f37de34c8b91e7c89c9c44b47931b0b93e705afef5cec04dcea1e0814ac40d325898bfc178eee17260f35b73b3c54bc031a821ece96435ca0be675ea691f96b
SSDEEP 49152:iGQXCV4YakpAPRgsgSDIMrbUMXt4H4cDaqRuEX/B5hEGvPuhxSMmT8oWgBCaXwaa:czx95QDLuEvBm+M4FHXwJT6+M4FHX
TLSH
T1C626C01EAE9802ECD0B7C178C9565903EBB27C0543605ADF0EA46976DF7BAE05A3F701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1782512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

GatherTelem.pdb

shell32

SHGetKnownFolderPath CommandLineToArgvW SHGetFolderPathW

kernel32

VirtualAlloc GetSystemInfo Sleep GetCurrentThreadId GetLogicalProcessorInformation FreeLibrary LoadLibraryExW SetHandleInformation CreatePipe CreateProcessW TerminateProcess WaitForMultipleObjects PeekNamedPipe GetExitCodeProcess InitializeProcThreadAttributeList UpdateProcThreadAttribute GetCurrentProcess LocalAlloc OutputDebugStringW GetCurrentProcessId OpenProcess LoadLibraryExA SetEnvironmentVariableW GetEnvironmentVariableW SetSearchPathMode HeapSetInformation SetDllDirectoryW ExpandEnvironmentStringsW SetEvent WaitForSingleObject SleepConditionVariableSRW GetConsoleMode WriteConsoleW GetFileInformationByHandleEx DeviceIoControl SetFilePointer SetEndOfFile GetFileInformationByHandle MoveFileExW ReplaceFileW FlushFileBuffers GetModuleFileNameW GetFileAttributesW GetStdHandle FileTimeToSystemTime FreeEnvironmentStringsW DeleteProcThreadAttributeList CreateEventW FormatMessageW IsValidCodePage AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeConditionVariable WakeConditionVariable InitializeSRWLock OutputDebugStringA MultiByteToWideChar FindClose FindNextFileW SetLastError FindFirstFileW GetModuleHandleW LocalFree GetCommandLineW GetDriveTypeW GetTickCount GetComputerNameExA IsProcessorFeaturePresent GetProcAddress GetLogicalDriveStringsW GetModuleHandleA GetVolumeInformationA GetDiskFreeSpaceW WideCharToMultiByte FindResourceW LoadResource FindResourceExW LockResource SizeofResource GetProcessHeap HeapDestroy HeapAlloc HeapReAlloc HeapSize HeapFree GetFileSize QueryPerformanceFrequency CreateFileW ReadFile GlobalFree GetPrivateProfileStringW RtlUnwind GetPrivateProfileSectionNamesW DeleteCriticalSection DecodePointer GetLastError InitializeCriticalSectionEx CloseHandle GetACP GetOEMCP GetEnvironmentStringsW WriteFile SetStdHandle GetTimeZoneInformation SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineA ExitProcess GetConsoleOutputCP ReadConsoleW GetFileType GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx GetCPInfo CompareStringEx LCMapStringEx EncodePointer LeaveCriticalSection EnterCriticalSection AcquireSRWLockShared RaiseException VirtualProtect VirtualQuery RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter WakeAllConditionVariable QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW FormatMessageA TryAcquireSRWLockExclusive WaitForSingleObjectEx SwitchToThread GetExitCodeThread GetLocaleInfoEx RtlPcToFileHeader FindFirstFileExW GetFileAttributesExW GetTempPathW AreFileApisANSI GetStringTypeW ReleaseSRWLockShared

advapi32

ConvertSidToStringSidA RegDeleteKeyExW RegSetKeySecurity RegCopyTreeW ConvertStringSecurityDescriptorToSecurityDescriptorW IsWellKnownSid CopySid GetLengthSid GetTokenInformation CreateWellKnownSid SetTokenInformation OpenProcessToken DuplicateTokenEx CreateProcessAsUserW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegDeleteTreeW RegDeleteValueW RegEnumValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW CryptDestroyKey CryptAcquireContextW CryptDecrypt CryptCreateHash CryptHashData CryptDestroyHash CryptSetKeyParam CryptImportKey CryptGetHashParam CryptReleaseContext

ole32

CLSIDFromString CoCreateInstance CoInitializeEx CoTaskMemFree CoSetProxyBlanket CoUninitialize

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDeriveKeyPBKDF2 BCryptGetProperty BCryptFinishHash BCryptCreateHash BCryptDestroyHash BCryptHashData

winhttp

WinHttpOpenRequest WinHttpSetOption WinHttpQueryAuthSchemes WinHttpWriteData WinHttpAddRequestHeaders WinHttpSetCredentials WinHttpSetStatusCallback WinHttpQueryOption WinHttpConnect WinHttpGetDefaultProxyConfiguration WinHttpOpen WinHttpGetProxyForUrl WinHttpCloseHandle WinHttpQueryHeaders WinHttpSendRequest WinHttpReceiveResponse

oleaut32

SysStringLen GetErrorInfo SafeArrayRedim SafeArrayDestroy VariantInit SafeArrayGetUBound SafeArrayGetElement SafeArrayUnlock SafeArrayGetLBound SafeArrayCopy SysStringByteLen SafeArrayGetVartype SysAllocStringByteLen SafeArrayLock SafeArrayCreate SysFreeString SysAllocString VariantCopy VariantClear

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

534KB

Virtual Size

533KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_2f268e410983699acce9e9cb18e68c47_glassworm_icedid_luca-stealer_njrat

shell32

kernel32

advapi32

ole32

bcrypt

winhttp

oleaut32

generic