2026-10-02_59b5a7182f7d7fe7ddda2efbe00fb714_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_59b5a7182f7d7fe7ddda2efbe00fb714_glassworm_icedid_luca-stealer_njrat_stealc
Size 48.1MB
Sample261003-papsasyw4p
SHA256 1d8464f7797a4a006df25fb1dea9ddd926684f4dca0d207294298573bec3ba55
MD5 59b5a7182f7d7fe7ddda2efbe00fb714
SHA1 ba185e8df4feb53a58cfdf81ea853bf1779a3b7f
SHA512 a95499b14159ac4333ff379b00d4b92985e071bf47f8014903b09f57b85dee2c29e11ab16f46b64d43eca8553b2a2165cbfa55f516507fcb65ac493dc426d6c0
SSDEEP 786432:3Yzolq2KDnj1ZujssXM+amhUegDx8pBh8K:Kz5ZmcYn+x8BJ
TLSH
T1CBB7CFE2876D5A9DF0617435C2E6856347F93D2822B4DF8E99E0EE13561FC9BF12200E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_59b5a7182f7d7fe7ddda2efbe00fb714_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-02_59b5a7182f7d7fe7ddda2efbe00fb714_glassworm_icedid_luca-stealer_njrat_stealc

.exe 48.1MB

2026-10-02_59b5a7182f7d7fe7ddda2efbe00fb714_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 0d6e224fce1b1cd07e9cf2319162f3b0
SHA256 1d8464f7797a4a006df25fb1dea9ddd926684f4dca0d207294298573bec3ba55
MD5 59b5a7182f7d7fe7ddda2efbe00fb714
SHA1 ba185e8df4feb53a58cfdf81ea853bf1779a3b7f
SHA512 a95499b14159ac4333ff379b00d4b92985e071bf47f8014903b09f57b85dee2c29e11ab16f46b64d43eca8553b2a2165cbfa55f516507fcb65ac493dc426d6c0
SSDEEP 786432:3Yzolq2KDnj1ZujssXM+amhUegDx8pBh8K:Kz5ZmcYn+x8BJ
TLSH
T1CBB7CFE2876D5A9DF0617435C2E6856347F93D2822B4DF8E99E0EE13561FC9BF12200E
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with VMProtect.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12735552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

OpenProcessToken GetSecurityDescriptorDacl GetTokenInformation SetNamedSecurityInfoW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction036 AddAccessAllowedAce GetLengthSid InitializeAcl IsValidSid RegCreateKeyExA RegDeleteKeyA SetSecurityInfo CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom

crypt32

CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptBinaryToStringA CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CryptMsgClose CryptMsgGetParam CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetCertificateContextProperty CryptQueryObject CryptProtectData CryptEncodeObjectEx CertOpenStore CertEnumCertificatesInStore CryptHashCertificate2 CertNameToStrW CertGetCertificateChain CertFreeCertificateChain CryptUnprotectData

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

dnsapi

DnsQuery_A DnsQuery_W DnsFree

shell32

ShellExecuteA SHGetKnownFolderPath

shlwapi

PathFindFileNameW

user32

ShowWindow IsWindowVisible IsIconic SetForegroundWindow AllowSetForegroundWindow GetClientRect EnumWindows GetWindowThreadProcessId GetWindow GetClassNameW TranslateMessage DispatchMessageW PeekMessageW SendMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow SetLayeredWindowAttributes GetSystemMetrics UpdateWindow GetWindowRect LoadImageW MoveWindow MessageBoxA OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode GetForegroundWindow SetCursorPos SetCursor GetCursorPos ClientToScreen ScreenToClient LoadCursorA

winhttp

WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryOption WinHttpConnect WinHttpOpen WinHttpCloseHandle

wintrust

WinVerifyTrust

ws2_32

getaddrinfo freeaddrinfo getsockopt send inet_ntop WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent ntohl WSACloseEvent closesocket WSAGetLastError ntohs WSASetLastError WSAStartup WSACleanup bind connect getpeername getsockname htons recv setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl inet_pton WSAWaitForMultipleEvents gethostname ioctlsocket listen recvfrom sendto

kernel32

GetCommandLineA GetOEMCP GetACP GetTimeZoneInformation GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue GetEnvironmentStringsW GetConsoleOutputCP ReadConsoleW GetConsoleMode SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW CreateProcessW DuplicateHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead CreatePipe IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer GetSystemTimeAsFileTime AreFileApisANSI GetFullPathNameW GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW GetLocaleInfoEx GetStringTypeW FormatMessageA SleepConditionVariableSRW TryAcquireSRWLockExclusive FreeEnvironmentStringsW SetEnvironmentVariableW GetCommandLineW SetStdHandle SetEndOfFile GetStartupInfoW IsValidCodePage HeapSize FlsAlloc GetProcessHeap HeapFree CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesW ReadFile RemoveDirectoryW SetFileAttributesW SetFileInformationByHandle WriteFile GetTempPathW CloseHandle GetLastError SetLastError WaitForSingleObject CreateEventW GetProcessTimes GetCurrentProcess GetCurrentProcessId CreateRemoteThread GetExitCodeThread ProcessIdToSessionId OpenProcess GetLocalTime GetTickCount64 VirtualAllocEx WriteProcessMemory CreateFileMappingW MapViewOfFile VirtualFreeEx UnmapViewOfFile GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LocalFree QueryFullProcessImageNameW GetFileInformationByHandleEx CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcessModules K32GetModuleBaseNameW GetFileInformationByHandle GetFileSizeEx GetSystemDirectoryW VirtualQuery FreeLibrary GetModuleFileNameW LoadLibraryExW WideCharToMultiByte Sleep GetFileAttributesA AddVectoredExceptionHandler QueryPerformanceCounter CreateThread GetCurrentThreadId VirtualProtect GetModuleFileNameA GetModuleHandleA AddDllDirectory SetDefaultDllDirectories SetDllDirectoryW K32GetModuleInformation GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar VerSetConditionMask QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LoadLibraryW SleepEx GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW InitializeCriticalSection GetSystemInfo CreateFileMappingA CreateFileA HeapAlloc HeapReAlloc WriteConsoleW

ole32

CoTaskMemFree

imm32

ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

12.4MB

Virtual Size

12.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

805KB

Virtual Size

805KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

30.8MB

Virtual Size

30.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_59b5a7182f7d7fe7ddda2efbe00fb714_glassworm_icedid_luca-stealer_njrat_stealc

advapi32

bcrypt

crypt32

d3d11

dwmapi

dnsapi

shell32

shlwapi

user32

winhttp

wintrust

ws2_32

kernel32

ole32

imm32

d3dcompiler_47

generic