2026-10-22_39c947ba2ae52a8a258512233e69601d_akira_glassworm_icedid_luca-stealer_njrat_rusty-stealer_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_39c947ba2ae52a8a258512233e69601d_akira_glassworm_icedid_luca-stealer_njrat_rusty-stealer_stealc
Size 7.8MB
Sample261024-ttkpxazz3j
SHA256 0bd9cd4c43b605502481791207b1d60df4f701d0bae6db3bf89dadc7becde7b9
MD5 39c947ba2ae52a8a258512233e69601d
SHA1 f4cdeaa106388221b46cfa9437560743029d42f8
SHA512 9b07c84e5c07c2e83e0eb9c321499916c97842586b49749bc8bb543475b6121cce0d9f99f0343e78a72aa6e42b57e597b3516833745e2051ff8f8170da33d0cd
SSDEEP 98304:F8PwDxjWXn+xb0Guq4ZWVEP92b0kNAWOlDVXmJLToOHo+:62WXaxcQVbRNJOlUZToN+
TLSH
T1D786BF17F7A400F8D4A6C178CA57862AE772BC4A4730A7DF17905A5A1F23BE09E3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_39c947ba2ae52a8a258512233e69601d_akira_glassworm_icedid_luca-stealer_njrat_rusty-stealer_stealc

File Explorer

2026-10-22_39c947ba2ae52a8a258512233e69601d_akira_glassworm_icedid_luca-stealer_njrat_rusty-stealer_stealc

.exe 7.8MB

2026-10-22_39c947ba2ae52a8a258512233e69601d_akira_glassworm_icedid_luca-stealer_njrat_rusty-stealer_stealc

IMPHASH f1c2f94462afbea317b75df8dda501ce
SHA256 0bd9cd4c43b605502481791207b1d60df4f701d0bae6db3bf89dadc7becde7b9
MD5 39c947ba2ae52a8a258512233e69601d
SHA1 f4cdeaa106388221b46cfa9437560743029d42f8
SHA512 9b07c84e5c07c2e83e0eb9c321499916c97842586b49749bc8bb543475b6121cce0d9f99f0343e78a72aa6e42b57e597b3516833745e2051ff8f8170da33d0cd
SSDEEP 98304:F8PwDxjWXn+xb0Guq4ZWVEP92b0kNAWOlDVXmJLToOHo+:62WXaxcQVbRNJOlUZToN+
TLSH
T1D786BF17F7A400F8D4A6C178CA57862AE772BC4A4730A7DF17905A5A1F23BE09E3D721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1610800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\o_installer\Build\x64\UnicodeRelease\SamanDownloader\SamanDownloader.pdb

kernel32

GetFileInformationByHandle GetModuleHandleA GetStdHandle HeapFree HeapAlloc GetProcessHeap GetFinalPathNameByHandleW K32GetModuleFileNameExW GetEnvironmentVariableW GetDiskFreeSpaceExW VerSetConditionMask VerifyVersionInfoW DuplicateHandle GetUserDefaultUILanguage SetDllDirectoryW GetExitCodeProcess FlushFileBuffers LoadLibraryExA VirtualQuery GetSystemInfo GetSystemDirectoryW SetEnvironmentVariableW GetOEMCP IsValidCodePage HeapSize ReadConsoleW SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType SetStdHandle GetTimeZoneInformation GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread GetCommandLineW GetCommandLineA TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx CancelIo SetFileAttributesW WriteFileEx ReadFileEx GetCurrentThread SetThreadStackGuarantee CreateThread FreeEnvironmentStringsW GetEnvironmentStringsW CompareStringOrdinal SetHandleInformation FindFirstFileExW GetFullPathNameW SetWaitableTimer CreateWaitableTimerExW WriteConsoleW GetConsoleOutputCP GetConsoleMode ReleaseMutex CreateMutexA LoadLibraryA HeapReAlloc GetOverlappedResult GetSystemTimePreciseAsFileTime InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException OutputDebugStringW IsDebuggerPresent GetCPInfo GetFileInformationByHandleEx GetTickCount64 GetSystemTimeAsFileTime SetFileInformationByHandle QueryPerformanceFrequency QueryPerformanceCounter LCMapStringEx EncodePointer LeaveCriticalSection EnterCriticalSection GetExitCodeThread SwitchToThread WaitForSingleObjectEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetStringTypeW SetLastError SetEndOfFile FreeLibrary lstrcmpiW lstrcpyW lstrcpynW GlobalAlloc LockResource SizeofResource FreeResource LoadResource FindResourceW SystemTimeToFileTime LocalFileTimeToFileTime GetFileAttributesW SetFileTime LocalFree FormatMessageW CreateDirectoryW InitializeCriticalSectionAndSpinCount ExitProcess lstrlenW GetTickCount WideCharToMultiByte GetCurrentDirectoryW GetProcAddress LoadLibraryW GetACP LoadLibraryExW GetLocalTime GetCurrentThreadId WriteFile GlobalUnlock GetCurrentProcessId GetFileSize GlobalLock MultiByteToWideChar GetVersionExW CreateFileW FindClose SetFilePointer FindNextFileW FindFirstFileW ReadFile MoveFileW CreateProcessW MoveFileExW CloseHandle Process32FirstW DeleteFileW TerminateThread GetWindowsDirectoryW Process32NextW CreateToolhelp32Snapshot OpenProcess WaitForSingleObject WaitForMultipleObjects CopyFileW GetModuleHandleW SetEvent CreateEventW GetModuleFileNameW MulDiv DeleteCriticalSection DecodePointer GetLastError Sleep InitializeCriticalSectionEx CreateMutexW RemoveDirectoryW TerminateProcess GetCurrentProcess SleepEx RtlUnwind GetTimeZoneInformationForYear

user32

IsClipboardFormatAvailable GetWindowRect SendMessageW SetWindowTextW SetTimer KillTimer SetForegroundWindow GetPropW GetClipboardData EmptyClipboard CloseClipboard OpenClipboard OffsetRect InflateRect UnionRect SetCursor LoadCursorW MonitorFromWindow GetDC ReleaseDC RegisterWindowMessageW ScreenToClient GetKeyState CharNextW PostQuitMessage EnumChildWindows GetWindowThreadProcessId GetShellWindow EnumWindows CharUpperW GetKeyNameTextW GetKeyboardLayout MapVirtualKeyExW DrawTextA GetGUIThreadInfo CreateAcceleratorTableW InvalidateRgn GetWindowTextW GetWindowTextLengthW EqualRect UpdateWindow IsWindowEnabled DestroyMenu TrackPopupMenu EnableMenuItem AppendMenuW CreatePopupMenu GetCaretBlinkTime ClientToScreen SetCaretPos GetCaretPos DestroyWindow ShowCaret CreateCaret CharPrevW SetRect DrawTextW FillRect GetWindowRgn UpdateLayeredWindow GetMenu AdjustWindowRectEx HideCaret SetPropW CallWindowProcW GetWindowLongPtrW RegisterClassExW GetClassInfoExW RegisterClassW EnableWindow ShowWindow SetWindowLongPtrW DefWindowProcW MessageBoxW SetWindowRgn MoveWindow LoadImageW GetParent PostMessageW SetCapture GetFocus IsZoomed DispatchMessageW TranslateMessage GetMessageW InvalidateRect GetSysColor ReleaseCapture PtInRect GetCursorPos CreateWindowExW GetMonitorInfoW MapWindowPoints IntersectRect IsWindowVisible IsWindow IsRectEmpty GetUpdateRect EndPaint BeginPaint SetFocus GetWindow GetActiveWindow IsIconic SetWindowLongW GetWindowLongW SetWindowPos GetClientRect

gdi32

GetBitmapBits GetTextExtentPointA CreatePatternBrush EnumFontFamiliesExW GdiFlush TextOutW GetTextExtentPoint32W GetCharABCWidthsW SetBkColor SetTextColor SetBkMode GetObjectA LineTo MoveToEx CreatePenIndirect CreateSolidBrush SetStretchBltMode SetBitmapBits StretchBlt CombineRgn ExtSelectClipRgn CreateRectRgnIndirect GetClipBox SelectClipRgn PtInRegion CreateRectRgn CreateDIBSection CreateRoundRectRgn PlayEnhMetaFile GetEnhMetaFileHeader CreateDIBitmap AddFontMemResourceEx GetTextMetricsW CloseEnhMetaFile CreateEnhMetaFileW SetWindowOrgEx Rectangle RestoreDC BitBlt SaveDC SelectObject CreateCompatibleDC DeleteDC RemoveFontMemResourceEx DeleteObject CreatePen CreateFontIndirectW GetStockObject GetObjectW GetDeviceCaps CreateCompatibleBitmap GetCurrentObject

advapi32

SystemFunction036 RegLoadKeyW OpenProcessToken RegEnumKeyExW RegQueryInfoKeyW GetUserNameW AllocateAndInitializeSid RegSetValueExW FreeSid CheckTokenMembership DuplicateTokenEx LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegOpenKeyExW

shell32

DragQueryFileW ShellExecuteW SHBrowseForFolderW SHCreateDirectoryExW SHChangeNotify SHGetSpecialFolderPathW SHGetSpecialFolderLocation SHGetPathFromIDListW

ole32

ReleaseStgMedium CreateStreamOnHGlobal OleLockRunning CLSIDFromString CLSIDFromProgID CoInitialize CoTaskMemAlloc RegisterDragDrop DoDragDrop CoCreateInstance OleDuplicateData CoUninitialize CoTaskMemFree CoInitializeSecurity

oleaut32

VariantInit SysFreeString VariantClear SysAllocString

comctl32

_TrackMouseEvent InitCommonControlsEx ord17

shlwapi

PathFindExtensionW SHDeleteKeyW SHSetValueW SHGetValueW PathFindFileNameW PathIsDirectoryW PathFileExistsW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

RtlNtStatusToDosError NtReadFile NtOpenFile RtlLookupFunctionEntry RtlCaptureContext NtWriteFile NtCreateNamedPipeFile RtlVirtualUnwind

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

916KB

Virtual Size

915KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

780KB

Virtual Size

780KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_39c947ba2ae52a8a258512233e69601d_akira_glassworm_icedid_luca-stealer_njrat_rusty-stealer_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

shlwapi

api-ms-win-core-synch-l1-2-0

ntdll

generic