2026-10-26_e2c692a5fc724fcb5cb89f3812739088_glassworm_icedid_megazord_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_e2c692a5fc724fcb5cb89f3812739088_glassworm_icedid_megazord_njrat_stealc
Size 24.0MB
Sample261027-e33jrays6p
SHA256 37f5b9ed952a19f23aa2ee90fdb1f8859eca737052784eef8fb1030fac635432
MD5 e2c692a5fc724fcb5cb89f3812739088
SHA1 0cb7e7cb250c5204bea756b5d17162814d0f034c
SHA512 3e369eec4b44eb2aa01b3b403a77842392482e86af45b2b306e8d691df2db6d915ec396e2aca3242508b96f92e09505957c123e0a4f25e199093e2f5273da87a
SSDEEP 393216:86s8YZpd0cUX03fmCDJq+wXXust5RDXtVH0CKVP1PyTuaBX4C/o/V7xe4m3QEHGJ:Y/Q7W
TLSH
T1B0477C42F76251E8C12AC474826B6633FB31785E472267EB57E48A313F66BD02B3DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_e2c692a5fc724fcb5cb89f3812739088_glassworm_icedid_megazord_njrat_stealc

File Explorer

2026-10-26_e2c692a5fc724fcb5cb89f3812739088_glassworm_icedid_megazord_njrat_stealc

.exe 24.0MB

2026-10-26_e2c692a5fc724fcb5cb89f3812739088_glassworm_icedid_megazord_njrat_stealc

IMPHASH ca443e6e7f1306d32497f27eb4c62312
SHA256 37f5b9ed952a19f23aa2ee90fdb1f8859eca737052784eef8fb1030fac635432
MD5 e2c692a5fc724fcb5cb89f3812739088
SHA1 0cb7e7cb250c5204bea756b5d17162814d0f034c
SHA512 3e369eec4b44eb2aa01b3b403a77842392482e86af45b2b306e8d691df2db6d915ec396e2aca3242508b96f92e09505957c123e0a4f25e199093e2f5273da87a
SSDEEP 393216:86s8YZpd0cUX03fmCDJq+wXXust5RDXtVH0CKVP1PyTuaBX4C/o/V7xe4m3QEHGJ:Y/Q7W
TLSH
T1B0477C42F76251E8C12AC474826B6633FB31785E472267EB57E48A313F66BD02B3DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16895964

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

sr_peer.pdb

kernel32

IsProcessorFeaturePresent GetStartupInfoW QueryFullProcessImageNameW GetSystemTimeAsFileTime CancelIoEx CreateSemaphoreA RtlPcToFileHeader GetOverlappedResult WaitForMultipleObjects GetExitCodeProcess FindNextFileW GetProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW IsDebuggerPresent GetNamedPipeClientProcessId ConnectNamedPipe GetEnvironmentStringsW FreeEnvironmentStringsW CreateEventW GlobalMemoryStatusEx GetLogicalProcessorInformation GetQueuedCompletionStatusEx GetFinalPathNameByHandleW CreateIoCompletionPort SetFileCompletionNotificationModes CreatePipe InitializeProcThreadAttributeList UpdateProcThreadAttribute TlsAlloc DeleteProcThreadAttributeList CreateProcessW ExpandEnvironmentStringsW RaiseException CreateFileMappingW MapViewOfFile GetCurrentDirectoryW WaitForSingleObjectEx CreateMutexA ReleaseMutex FlsAlloc IsThreadAFiber FlsSetValue FlsFree GetEnvironmentVariableW SleepEx ReadFileEx WriteFileEx GetFullPathNameW FindFirstFileExW SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx ExitProcess CancelIo GetWindowsDirectoryW GetFileAttributesW GetCommandLineW GetTempPathW RemoveDirectoryW DeleteFileW CopyFileExW MoveFileExW GetProcessTimes VirtualQueryEx GetSystemTimes GetProcessIoCounters UnmapViewOfFile GetTickCount64 CreateDirectoryW GetComputerNameExW CreateNamedPipeW GetSystemDirectoryW SetFileInformationByHandle InitializeSRWLock EncodePointer InitializeConditionVariable ReleaseSRWLockExclusive AcquireSRWLockExclusive InitOnceBeginInitialize InitOnceComplete WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FlushFileBuffers RtlUnwind TlsGetValue TlsSetValue TlsFree GetProcAddress LoadLibraryExA GetTimeZoneInformationForYear ExitThread ResumeThread QueueUserAPC VirtualAllocEx GetCommandLineA GetNativeSystemInfo GetFileSizeEx SetEnvironmentVariableW HeapSize SetEndOfFile GetCurrentThreadId DeviceIoControl CreateFileW PostQueuedCompletionStatus GetCurrentProcess OpenProcess SetWaitableTimer CreateWaitableTimerExW TerminateProcess GetLogicalProcessorInformationEx GetCurrentProcessId WriteFile ReadFile GetNamedPipeInfo GetFileType Sleep GetSystemInfo ReleaseSemaphore SetEvent WaitForMultipleObjectsEx SwitchToThread SetThreadPriority SetFilePointerEx GetSystemTimePreciseAsFileTime CreateThread VerifyVersionInfoW VerSetConditionMask GetLogicalDrives FindClose WaitForSingleObject CreateEventA GlobalAlloc GlobalUnlock GlobalSize GlobalLock HeapReAlloc GetCurrentThread SetThreadStackGuarantee HeapAlloc HeapFree GetProcessHeap ReadProcessMemory RtlLookupFunctionEntry FreeLibrary SetLastError SetHandleInformation LocalFree DuplicateHandle WriteProcessMemory FormatMessageW SetThreadErrorMode SetErrorMode CreateSemaphoreW OutputDebugStringW CloseHandle GlobalFree LocalAlloc GetLastError ProcessIdToSessionId WTSGetActiveConsoleSessionId GetModuleHandleA RtlUnwindEx InitializeCriticalSectionAndSpinCount FreeLibraryAndExitThread SetConsoleCtrlHandler InitializeSListHead SetStdHandle QueryPerformanceCounter GetModuleHandleExA SetThreadExecutionState WideCharToMultiByte QueryPerformanceFrequency K32GetPerformanceInfo lstrcmpiW LoadLibraryA CompareStringW LoadLibraryW LoadLibraryExW lstrlenW SetUnhandledExceptionFilter RtlCaptureContext RtlVirtualUnwind GetModuleHandleW MultiByteToWideChar UnhandledExceptionFilter AddVectoredExceptionHandler GetStdHandle GetConsoleMode LCMapStringW GetCPInfo GetOEMCP CompareStringOrdinal GetACP GetConsoleOutputCP IsValidCodePage WriteConsoleW ReadConsoleW GetStringTypeW GetModuleHandleExW InitializeCriticalSection TryEnterCriticalSection SleepConditionVariableCS LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionEx GetModuleFileNameW

advapi32

LookupPrivilegeValueW CopySid IsValidSid SetNamedSecurityInfoW ConvertStringSidToSidW ConvertStringSecurityDescriptorToSecurityDescriptorW AdjustTokenPrivileges CreateWellKnownSid GetLengthSid LookupAccountSidW EqualSid LogonUserW GetNamedSecurityInfoW IsWellKnownSid SetSecurityDescriptorDacl FreeSid AllocateAndInitializeSid RegOpenKeyExW RegQueryValueExW RegCloseKey InitializeSecurityDescriptor GetTokenInformation CreateProcessAsUserW CreateProcessWithLogonW RegDeleteValueW ConvertSidToStringSidW DuplicateToken RegSetValueExW ImpersonateAnonymousToken RevertToSelf RegEnumValueW OpenProcessToken SetEntriesInAclW RegEnumKeyExW GetUserNameW CloseServiceHandle OpenSCManagerW SystemFunction036 OpenServiceW QueryServiceStatusEx

bcryptprimitives

ProcessPrng

crypt32

CertAddCertificateContextToStore CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertEnumCertificatesInStore CertDuplicateCertificateChain CertDuplicateStore CertOpenStore CertVerifyTimeValidity CertGetEnhancedKeyUsage CertDuplicateCertificateContext CertFreeCertificateContext CertCloseStore

ntdll

NtDeviceIoControlFile NtReadFile NtWriteFile NtOpenFile NtCancelIoFileEx NtCreateNamedPipeFile NtCreateFile NtQuerySystemInformation NtQueryInformationProcess RtlGetVersion RtlNtStatusToDosError

bcrypt

BCryptGenRandom

oleaut32

GetErrorInfo SysStringLen SysFreeString

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ole32

CoInitializeEx CoTaskMemFree CoCreateInstance PropVariantClear CoUninitialize

shell32

SHGetKnownFolderPath ShellExecuteA ShellExecuteW ShellExecuteExW CommandLineToArgvW

user32

LockWorkStation GetSystemMetrics DefWindowProcA LoadCursorA BlockInput GetWindowThreadProcessId GetForegroundWindow CreateWindowExA ShowWindow GetIconInfo RemoveClipboardFormatListener AddClipboardFormatListener GetDisplayConfigBufferSizes QueryDisplayConfig DisplayConfigGetDeviceInfo SystemParametersInfoW PostThreadMessageA SetWindowsHookExA TranslateMessage GetMonitorInfoA EnumDisplayMonitors GetMessageA DispatchMessageA EnumDisplaySettingsExW EnumDisplayDevicesW ChangeDisplaySettingsExW OpenClipboard EnumDisplaySettingsW IsClipboardFormatAvailable RegisterClassExA ExitWindowsEx UnhookWindowsHookEx CallNextHookEx GetClipboardData OpenInputDesktop SetThreadDesktop CloseDesktop GetThreadDesktop GetUserObjectInformationA RegisterClipboardFormatW VkKeyScanExW GetKeyState SetWindowPos MapVirtualKeyExW FindWindowExA GetKeyboardLayout PostMessageA GetWindowRect IsWindowVisible SendInput GetDC SetClipboardData AllowSetForegroundWindow EmptyClipboard GetCursorPos GetCursorInfo DestroyWindow DispatchMessageW GetMessageW CreateWindowExW PostMessageW ReleaseDC CloseClipboard

userenv

DestroyEnvironmentBlock GetUserProfileDirectoryW CreateEnvironmentBlock

sas

SendSAS

newdev

UpdateDriverForPlugAndPlayDevicesW

wtsapi32

WTSEnumerateSessionsA WTSQuerySessionInformationW WTSQuerySessionInformationA WTSFreeMemory

gdi32

SelectObject BitBlt CreateCompatibleDC CreateDIBitmap CreateCompatibleBitmap GetObjectA DeleteObject CreateDCW DeleteDC GetBitmapBits GetDIBits

pdh

PdhCollectQueryDataEx PdhAddEnglishCounterW PdhCollectQueryData PdhRemoveCounter PdhGetFormattedCounterValue PdhCloseQuery PdhAddEnglishCounterA PdhOpenQueryA

ws2_32

getaddrinfo recvfrom getsockname WSAStartup freeaddrinfo socket getpeername accept getsockopt sendto WSASend WSAIoctl bind ioctlsocket WSASocketW shutdown closesocket setsockopt connect send recv WSAGetLastError listen

iphlpapi

GetAdaptersAddresses SendARP GetBestInterface

secur32

QueryContextAttributesW InitializeSecurityContextW DecryptMessage ApplyControlToken FreeCredentialsHandle DeleteSecurityContext EncryptMessage FreeContextBuffer AcquireCredentialsHandleA AcceptSecurityContext

d3d11

D3D11CreateDevice

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiSetDeviceRegistryPropertyW SetupDiCallClassInstaller SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsExW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

cfgmgr32

CM_Get_DevNode_Status

winspool.drv

EnumPrintersW

dxgi

CreateDXGIFactory1

psapi

GetProcessMemoryInfo GetModuleFileNameExW

powrprof

CallNtPowerInformation

Name

.text

Size

16.5MB

Virtual Size

16.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.1MB

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

402KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

284KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_e2c692a5fc724fcb5cb89f3812739088_glassworm_icedid_megazord_njrat_stealc

kernel32

advapi32

bcryptprimitives

crypt32

ntdll

bcrypt

oleaut32

api-ms-win-core-synch-l1-2-0

ole32

shell32

user32

userenv

sas

newdev

wtsapi32

gdi32

pdh

ws2_32

iphlpapi

secur32

d3d11

setupapi

cfgmgr32

winspool.drv

dxgi

psapi

powrprof

generic