2026-10-06_2e3d3e229c9881e47b9be06a638491a8_amadey_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-06_2e3d3e229c9881e47b9be06a638491a8_amadey_glassworm_icedid_luca-stealer_njrat_stealc
Size 7.4MB
Sample261006-rwdy2act7n
SHA256 5da1c744c4dfd29f41aa1e23a89d0ccbaecbf7a34db15dc4b6d8e1513f299ee3
MD5 2e3d3e229c9881e47b9be06a638491a8
SHA1 b9031fdc78b26751edd666fca0caedd779934da1
SHA512 2975ca2ebba0407e0cf6e88e26a2c6532e1935937d31371d5f62ee660508c27bb05ed692e00e3ac234da9ec0d359def509a05050d437e015c193180c38cac8bc
SSDEEP 98304:WBNPneEqnlSfQgGD5BuqBVsR3uHycJz8xnTT+IcFa:ONPeEsSoBDXuGqu21+U
TLSH
T108769E1EEF7441F5C0F6C079CA829557EA71384A4730A6E71AC18F692F177E2DA3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-06_2e3d3e229c9881e47b9be06a638491a8_amadey_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-06_2e3d3e229c9881e47b9be06a638491a8_amadey_glassworm_icedid_luca-stealer_njrat_stealc

.exe 7.4MB

2026-10-06_2e3d3e229c9881e47b9be06a638491a8_amadey_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 86829409404d57408058a98bed4c72f1
SHA256 5da1c744c4dfd29f41aa1e23a89d0ccbaecbf7a34db15dc4b6d8e1513f299ee3
MD5 2e3d3e229c9881e47b9be06a638491a8
SHA1 b9031fdc78b26751edd666fca0caedd779934da1
SHA512 2975ca2ebba0407e0cf6e88e26a2c6532e1935937d31371d5f62ee660508c27bb05ed692e00e3ac234da9ec0d359def509a05050d437e015c193180c38cac8bc
SSDEEP 98304:WBNPneEqnlSfQgGD5BuqBVsR3uHycJz8xnTT+IcFa:ONPeEsSoBDXuGqu21+U
TLSH
T108769E1EEF7441F5C0F6C079CA829557EA71384A4730A6E71AC18F692F177E2DA3A720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2214960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\user\Documents\Project1\scratch-fm\codex-agents\scruz1\repo\server-client\clients\native\bin\Release\RemoteAdmin.Client.pdb

bcrypt

BCryptImportKeyPair BCryptVerifySignature BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptHash BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGetProperty BCryptDestroyKey BCryptEncrypt

ncrypt

NCryptSetProperty NCryptFreeObject NCryptCreatePersistedKey NCryptOpenKey NCryptOpenStorageProvider NCryptSignHash NCryptExportKey NCryptFinalizeKey NCryptDeleteKey

crypt32

CryptStringToBinaryA CryptBinaryToStringA CertCreateCertificateContext CertFreeCertificateContext CryptEncodeObjectEx CertVerifyTimeValidity

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpQueryOption WinHttpSetTimeouts WinHttpSendRequest WinHttpWriteData WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle

secur32

QueryContextAttributesA ApplyControlToken FreeContextBuffer DecryptMessage AcquireCredentialsHandleA EncryptMessage FreeCredentialsHandle InitializeSecurityContextA DeleteSecurityContext

gdiplus

GdipSaveImageToStream GdipFree GdipSetInterpolationMode GdipDeleteGraphics GdipGetImageGraphicsContext GdipGetImageEncodersSize GdipCreateBitmapFromScan0 GdiplusStartup GdipDrawImageRectI GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdipDisposeImage

ole32

CoCreateInstance CreateStreamOnHGlobal CoCreateGuid StringFromGUID2 GetHGlobalFromStream CoInitializeEx CoUninitialize CoTaskMemFree

oleaut32

VariantInit SysFreeString SysStringLen

shell32

SHGetKnownFolderPath

user32

EnumDisplaySettingsExW QueryDisplayConfig GetDisplayConfigBufferSizes DisplayConfigGetDeviceInfo EqualRect ReleaseDC MessageBoxW MapVirtualKeyW GetSystemMetrics SetThreadDesktop CloseDesktop OpenInputDesktop GetUserObjectInformationW SendInput PtInRect GetProcessWindowStation GetCursorInfo GetThreadDesktop GetIconInfo MonitorFromRect GetDC

gdi32

DeleteObject DeleteDC GdiFlush SetBrushOrgEx StretchBlt GetDIBits GetObjectW SetStretchBltMode BitBlt SelectObject CreateDIBSection CreateCompatibleDC

advapi32

CreateRestrictedToken LookupAccountSidW DuplicateTokenEx RegGetValueW GetUserNameW GetSecurityDescriptorDacl GetAce ConvertSecurityDescriptorToStringSecurityDescriptorW GetSecurityDescriptorOwner IsValidSid ConvertSidToStringSidW EqualSid CreateWellKnownSid LookupPrivilegeValueW AdjustTokenPrivileges SetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW RevertToSelf GetAclInformation SetEntriesInAclW SetNamedSecurityInfoW GetSecurityDescriptorControl GetNamedSecurityInfoW ImpersonateLoggedOnUser OpenProcessToken CreateProcessAsUserW GetTokenInformation

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQuerySessionInformationW WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

powrprof

PowerSettingRegisterNotification PowerSettingUnregisterNotification

iphlpapi

CancelMibChangeNotify2 NotifyIpInterfaceChange

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

ntdll

RtlNtStatusToDosError NtCreateFile RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlUnwind

kernel32

FormatMessageA AreFileApisANSI FindNextFileW FindFirstFileExW FindFirstFileW GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA FreeLibraryAndExitThread ExitThread GetLocaleInfoEx GetNativeSystemInfo GetExitCodeThread SwitchToThread WaitForSingleObjectEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetStringTypeW GetCPInfo UnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead LoadLibraryExA FreeLibrary VirtualQuery VirtualProtect GetSystemInfo SetFileInformationByHandle WaitForMultipleObjects GetOEMCP QueryPerformanceCounter QueryPerformanceFrequency InitOnceComplete InitOnceBeginInitialize IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW InitializeCriticalSectionEx HeapReAlloc IsValidCodePage GetACP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer ConnectNamedPipe GenerateConsoleCtrlEvent CopyFileW GetOverlappedResult FindResourceW LoadResource ResetEvent FreeConsole LockResource AttachConsole GetProcessId DecodePointer LocalFree CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount CreateDirectoryW ReadFile SetConsoleCtrlHandler GetVolumeInformationW CompareFileTime GetFileSizeEx SetHandleInformation SetLastError GetCurrentProcess WriteFile RemoveDirectoryW SetFileTime InitializeProcThreadAttributeList CompareStringOrdinal CreatePipe GetEnvironmentVariableW PeekNamedPipe FindClose WaitForSingleObject CreateFileW GetFileAttributesW SetFileAttributesW GetLogicalDriveStringsW Sleep GetTickCount64 GetLastError UpdateProcThreadAttribute GetFileAttributesExW GetDiskFreeSpaceExW DeleteFileW CloseHandle FindNLSStringEx DeleteProcThreadAttributeList GetWindowsDirectoryW CreateNamedPipeW MoveFileExW FindFirstStreamW GetCurrentProcessId CreateProcessW CreateSymbolicLinkW GetSystemTimeAsFileTime FindNextStreamW GetVolumeInformationByHandleW GetProcessTimes GetDriveTypeW GetSystemTimePreciseAsFileTime FlushFileBuffers GetExitCodeProcess PowerSetRequest PowerCreateRequest PowerClearRequest SetDefaultDllDirectories GetHandleInformation GetProcessMitigationPolicy SetProcessMitigationPolicy CreateEventW UnmapViewOfFile SetEvent CancelIoEx MapViewOfFile SetInformationJobObject QueryInformationJobObject GetModuleFileNameW CreateJobObjectW DuplicateHandle K32GetProcessMemoryInfo CreateFileMappingW GetProcessHandleCount GetCurrentThread GetThreadTimes WTSGetActiveConsoleSessionId GetFinalPathNameByHandleW MultiByteToWideChar GetActiveProcessorCount GetProcAddress GetComputerNameW GetModuleHandleW WideCharToMultiByte GetProductInfo GetStdHandle UnlockFileEx OpenEventW LockFileEx GetFileType GetFileInformationByHandleEx GetFullPathNameW GetLongPathNameW GetShortPathNameW SetEndOfFile GetTempPathW CreateHardLinkW GetVolumePathNameW GetFileInformationByHandle SetFilePointerEx TerminateProcess SetErrorMode GetCurrentThreadId RaiseException ExitProcess GetSystemTime SetUnhandledExceptionFilter LoadLibraryExW ProcessIdToSessionId GlobalLock GlobalUnlock CreateSemaphoreW CreateMutexW OpenMutexW SizeofResource LCMapStringEx

dwmapi

DwmIsCompositionEnabled

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

568KB

Virtual Size

567KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

212KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

328B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-06_2e3d3e229c9881e47b9be06a638491a8_amadey_glassworm_icedid_luca-stealer_njrat_stealc

bcrypt

ncrypt

crypt32

winhttp

secur32

gdiplus

ole32

oleaut32

shell32

user32

gdi32

advapi32

wtsapi32

userenv

powrprof

iphlpapi

d3d11

dxgi

ntdll

kernel32

dwmapi

generic