2026-10-01_c394b28e5b2d3edb5622ec0f3a57a425_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_c394b28e5b2d3edb5622ec0f3a57a425_glassworm_icedid_luca-stealer_njrat_stealc
Size 2.2MB
Sample261002-d3ra2st1fv
SHA256 4835cd4b50c1155a52ebd6a25a184884c2430c04785157fba901d6a65525b0e3
MD5 c394b28e5b2d3edb5622ec0f3a57a425
SHA1 f0bbdcfba66349a31d8e96ef2e9f7cdebb1d8b09
SHA512 c2127cdc1254b325c374ef95fada551bf98575e13ab14c687736ad5174aff6f1b24c263cbd033ea3c2612dd204e50c125140462c706496b4e65c3e1715fd0fd7
SSDEEP 49152:2y3D4E2gqNQ5vlTXR8TixiMenx59ZYoXMfnKn+N1N3bwJbbWhvUnuK:34klNxiMenx59ZYnfnLNTbxZ
TLSH
T178B59E46A6B501E8C1A7C17CC6479617E77274091330ABEF23E48AA52F23BE56F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_c394b28e5b2d3edb5622ec0f3a57a425_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-01_c394b28e5b2d3edb5622ec0f3a57a425_glassworm_icedid_luca-stealer_njrat_stealc

.exe 2.2MB

2026-10-01_c394b28e5b2d3edb5622ec0f3a57a425_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 28372bd183113e5694c3d88fd2cb7fdb
SHA256 4835cd4b50c1155a52ebd6a25a184884c2430c04785157fba901d6a65525b0e3
MD5 c394b28e5b2d3edb5622ec0f3a57a425
SHA1 f0bbdcfba66349a31d8e96ef2e9f7cdebb1d8b09
SHA512 c2127cdc1254b325c374ef95fada551bf98575e13ab14c687736ad5174aff6f1b24c263cbd033ea3c2612dd204e50c125140462c706496b4e65c3e1715fd0fd7
SSDEEP 49152:2y3D4E2gqNQ5vlTXR8TixiMenx59ZYoXMfnKn+N1N3bwJbbWhvUnuK:34klNxiMenx59ZYnfnLNTbxZ
TLSH
T178B59E46A6B501E8C1A7C17CC6479617E77274091330ABEF23E48AA52F23BE56F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1498560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\FreezeSolutions\StandardPlan\x64\Release\Wexize Loader.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

wininet

HttpOpenRequestA HttpQueryInfoA InternetCloseHandle InternetOpenUrlA InternetSetOptionA HttpSendRequestA InternetConnectA InternetReadFile InternetOpenA

ws2_32

recvfrom __WSAFDIsSet WSAIoctl getsockname getpeername connect WSASetLastError ntohs WSAGetLastError WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents sendto WSACloseEvent ioctlsocket ntohl inet_pton getaddrinfo inet_ntop freeaddrinfo WSACleanup accept bind closesocket select listen WSAStartup send socket recv htonl htons setsockopt getsockopt gethostname WSACreateEvent

crypt32

CertCloseStore CertOpenStore CertFreeCertificateChainEngine CertGetCertificateChain CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertCreateCertificateChainEngine CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertFreeCertificateChain

advapi32

CryptGetHashParam RegCreateKeyExA RegDeleteKeyA ConvertSidToStringSidW CopySid CryptAcquireContextW CryptReleaseContext CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt SystemFunction036 InitializeAcl SetSecurityInfo GetLengthSid GetTokenInformation OpenProcessToken ConvertSidToStringSidA AddAccessAllowedAce IsValidSid

dnsapi

DnsQuery_A DnsFree

wintrust

WinVerifyTrust

psapi

GetModuleInformation

shell32

ShellExecuteExW ShellExecuteA

comdlg32

GetOpenFileNameW

kernel32

RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW DuplicateHandle CreateProcessW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetConsoleMode ReadConsoleW GetConsoleOutputCP FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation WaitForSingleObject GetExitCodeProcess CreatePipe SetStdHandle RtlPcToFileHeader RtlUnwindEx RaiseException OutputDebugStringW InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetEndOfFile GetFileSizeEx WritePrivateProfileStringW GetCurrentProcess WriteFile GetModuleFileNameW CreateFileW GetFileAttributesW GetPrivateProfileStringW GetLastError GlobalAlloc DeleteFileW IsValidCodePage GlobalLock SetFilePointerEx LocalFree ExitProcess WideCharToMultiByte GlobalUnlock IsDebuggerPresent CheckRemoteDebuggerPresent FlushFileBuffers MultiByteToWideChar GlobalFree GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GetModuleFileNameA VirtualProtect HeapFree SetDefaultDllDirectories AddDllDirectory InitializeCriticalSectionEx GetCurrentThreadId GetSystemDirectoryW UnmapViewOfFile HeapSize Sleep GetTickCount64 GetFileAttributesA HeapReAlloc CreateThread HeapAlloc DecodePointer AddVectoredExceptionHandler HeapDestroy DeleteCriticalSection GetCurrentProcessId GetProcessHeap GetModuleHandleW QueryFullProcessImageNameW CreateFileMappingW MapViewOfFile SetDllDirectoryW VirtualQuery ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageW EnterCriticalSection LeaveCriticalSection LoadLibraryW SleepEx GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WriteConsoleW VerifyVersionInfoW InitializeCriticalSection GetSystemInfo VirtualAlloc CreateFileA CreateFileMappingA TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW WakeAllConditionVariable LCMapStringEx EncodePointer GetSystemTimeAsFileTime GetLocaleInfoEx GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW CloseHandle WaitForMultipleObjects FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW FormatMessageA TryAcquireSRWLockExclusive SleepConditionVariableSRW

user32

PostQuitMessage UpdateWindow SetClipboardData MessageBoxA GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos DefWindowProcW DestroyWindow IsWindowVisible CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow OpenClipboard DispatchMessageW CloseClipboard EmptyClipboard PeekMessageW GetWindowTextA EnumWindows TranslateMessage GetClipboardData FindWindowA

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

449KB

Virtual Size

448KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_c394b28e5b2d3edb5622ec0f3a57a425_glassworm_icedid_luca-stealer_njrat_stealc

d3d11

d3dcompiler_47

wininet

ws2_32

crypt32

advapi32

dnsapi

wintrust

psapi

shell32

comdlg32

kernel32

user32

imm32

shlwapi

userenv

bcrypt

generic