2026-10-26_6266a65b2e4559ca20b9861121acdbb3_amadey_glassworm_icedid_konni_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_6266a65b2e4559ca20b9861121acdbb3_amadey_glassworm_icedid_konni_luca-stealer_njrat_stealc
Size 13.9MB
Sample261027-tff5kafs2p
SHA256 4649874a25439a4724258e5f2de2415032c1011170e38631d493b3d15d22826d
MD5 6266a65b2e4559ca20b9861121acdbb3
SHA1 cb90bc53cab0d345f64185bdde3576207276418f
SHA512 b767418a0783c98b4fd1baed81e464712a40774dc905380a55de855499f0c30d0134786d91b0863c3e42b88449786dec7d8473c0813f43f5fa9f8a198752c08b
SSDEEP 98304:J0wCSSX23hGUHiMKfQgGD5BuqBVsR3uHycJz8xnTT+IcFa:JM2RDHi5oBDXuGqu21+U
TLSH
T100E6E61EAB7982E1C0F6D079C583A52BFC7178AAC33467E756429B162F167E1E83D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_6266a65b2e4559ca20b9861121acdbb3_amadey_glassworm_icedid_konni_luca-stealer_njrat_stealc

File Explorer

2026-10-26_6266a65b2e4559ca20b9861121acdbb3_amadey_glassworm_icedid_konni_luca-stealer_njrat_stealc

.exe 13.9MB

2026-10-26_6266a65b2e4559ca20b9861121acdbb3_amadey_glassworm_icedid_konni_luca-stealer_njrat_stealc

IMPHASH 12cd90e72c3ad0929c648916f5188304
SHA256 4649874a25439a4724258e5f2de2415032c1011170e38631d493b3d15d22826d
MD5 6266a65b2e4559ca20b9861121acdbb3
SHA1 cb90bc53cab0d345f64185bdde3576207276418f
SHA512 b767418a0783c98b4fd1baed81e464712a40774dc905380a55de855499f0c30d0134786d91b0863c3e42b88449786dec7d8473c0813f43f5fa9f8a198752c08b
SSDEEP 98304:J0wCSSX23hGUHiMKfQgGD5BuqBVsR3uHycJz8xnTT+IcFa:JM2RDHi5oBDXuGqu21+U
TLSH
T100E6E61EAB7982E1C0F6D079C583A52BFC7178AAC33467E756429B162F167E1E83D700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6681704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlUnwindEx NtCreateFile RtlNtStatusToDosError RtlUnwind

bcrypt

BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptGenRandom BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptSetProperty BCryptFinishHash BCryptDestroyKey BCryptVerifySignature BCryptImportKeyPair BCryptHash BCryptDestroyHash BCryptGetProperty BCryptHashData BCryptCreateHash

ncrypt

NCryptFreeObject NCryptOpenStorageProvider NCryptOpenKey NCryptCreatePersistedKey NCryptSetProperty NCryptFinalizeKey NCryptExportKey NCryptDeleteKey NCryptSignHash

crypt32

CryptEncodeObjectEx CertVerifyTimeValidity CryptStringToBinaryA CryptBinaryToStringA CertCreateCertificateContext CertFreeCertificateContext CertGetNameStringW

winhttp

WinHttpCloseHandle WinHttpSetOption WinHttpOpen WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpWriteData WinHttpQueryOption WinHttpQueryDataAvailable

secur32

GetUserNameExW FreeCredentialsHandle InitializeSecurityContextA DeleteSecurityContext ApplyControlToken QueryContextAttributesA FreeContextBuffer EncryptMessage DecryptMessage AcquireCredentialsHandleA

gdiplus

GdipGetImageEncoders GdipSetInterpolationMode GdipGetImageEncodersSize GdiplusStartup GdipAlloc GdiplusShutdown GdipFree GdipCloneImage GdipDisposeImage GdipSaveImageToStream GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipDeleteGraphics GdipDrawImageRectI

ole32

CoCreateGuid CoCreateInstance GetHGlobalFromStream CoUninitialize CreateStreamOnHGlobal CoTaskMemFree CoInitializeEx StringFromGUID2

oleaut32

VariantInit SysFreeString SysStringLen

shell32

SHGetPathFromIDListW CommandLineToArgvW ExtractIconExW ord155 SHGetDesktopFolder SHGetKnownFolderPath ord152

user32

BeginPaint EndPaint InvalidateRect GetClientRect InflateRect GetWindowLongPtrW SetWindowLongPtrW LoadCursorW PeekMessageW EnumDisplayMonitors GetDpiForWindow GetKeyboardLayout EnumDesktopWindows PostMessageW GetDoubleClickTime IsWindow IsWindowVisible IsIconic IsZoomed MapVirtualKeyExW IsWindowEnabled GetMenu GetMenuState GetSubMenu GetMenuItemInfoW GetMenuItemRect MenuItemFromPoint RedrawWindow SetPropW GetPropW RemovePropW GetWindowRect ClientToScreen ScreenToClient GetClassLongPtrW GetParent GetClassNameW GetTopWindow GetWindow GetAncestor OpenDesktopW GetMessageW PostQuitMessage RegisterClassW ShowWindow GetWindowTextW DestroyIcon DrawIconEx ShowWindowAsync DrawTextW DispatchMessageW SystemParametersInfoW CreateDesktopW EnumDesktopsW EnumDisplaySettingsW IsHungAppWindow PrintWindow MoveWindow MsgWaitForMultipleObjects SetWindowTextW GetGuiResources MonitorFromPoint MonitorFromWindow GetWindowPlacement SetWindowPlacement IsImmersiveProcess GetIconInfo TranslateMessage MessageBoxW GetGUIThreadInfo GetForegroundWindow GetSystemMetrics MapVirtualKeyW DestroyWindow CreateWindowExW SendMessageTimeoutW EnumDisplayDevicesW FillRect CreateIconIndirect DestroyCursor CreateCursor ReleaseDC GetDC GetProcessWindowStation GetThreadDesktop MonitorFromRect DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes EnumDisplaySettingsExW EqualRect GetUserObjectInformationW CloseDesktop SetThreadDesktop OpenInputDesktop SendInput GetCursorInfo PtInRect CharUpperBuffW UpdateWindow SetWindowPos RegisterClassExW DefWindowProcW CallNextHookEx SetThreadDpiAwarenessContext UnhookWindowsHookEx SetWindowsHookExW MsgWaitForMultipleObjectsEx GetLastInputInfo PostThreadMessageW GetMonitorInfoW GetWindowThreadProcessId GetWindowTextLengthW

gdi32

CreateCompatibleDC GetObjectW DeleteDC SetBkMode GetStockObject CreateFontW GetDIBits GdiFlush SetBrushOrgEx CreateDIBSection SetStretchBltMode StretchBlt SelectObject DeleteObject SetTextColor PatBlt GetPixel CreateCompatibleBitmap CreateSolidBrush TextOutW BitBlt CreateBitmap

advapi32

RegEnumKeyExW LookupPrivilegeValueW SetTokenInformation GetSecurityDescriptorDacl GetAce AdjustTokenPrivileges ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW RevertToSelf ImpersonateLoggedOnUser CreateRestrictedToken SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW GetSecurityDescriptorControl GetAclInformation DuplicateTokenEx CreateProcessAsUserW LookupAccountSidW GetTokenInformation OpenProcessToken RegOpenKeyExW RegQueryInfoKeyW RegCloseKey RegGetValueW LookupAccountNameW CreateWellKnownSid EqualSid RegQueryValueExW RegLoadAppKeyW RegCreateKeyExW RegSetValueExW RegDeleteTreeW CopySid GetLengthSid GetSecurityInfo ConvertSidToStringSidA AddAccessAllowedAce InitializeAcl GetUserNameW ConvertSecurityDescriptorToStringSecurityDescriptorW GetSecurityDescriptorOwner OpenSCManagerW EnumServicesStatusExW CloseServiceHandle GetSidSubAuthorityCount GetSidSubAuthority SetSecurityDescriptorDacl IsValidSid InitializeSecurityDescriptor

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQuerySessionInformationW WTSQueryUserToken

userenv

DestroyEnvironmentBlock GetUserProfileDirectoryW CreateEnvironmentBlock

powrprof

PowerSettingRegisterNotification PowerSettingUnregisterNotification

iphlpapi

NotifyIpInterfaceChange CancelMibChangeNotify2

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

imm32

ImmGetDefaultIMEWnd

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoExW GetFileVersionInfoSizeExW GetFileVersionInfoSizeW

shlwapi

StrRetToBufW

wintrust

WTHelperProvDataFromStateData CryptCATCatalogInfoFromContext CryptCATAdminCalcHashFromFileHandle2 WinVerifyTrust CryptCATAdminEnumCatalogFromHash CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext CryptCATAdminAcquireContext2 WTHelperGetProvSignerFromChain

api-ms-win-core-file-l1-1-0

GetFileAttributesExW FindFirstFileExW GetDriveTypeW GetFileSizeEx ReadFile GetDiskFreeSpaceExW DeleteFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW SetFileTime CreateFileW GetShortPathNameW UnlockFileEx GetLogicalDriveStringsW FindClose FlushFileBuffers GetVolumeInformationByHandleW WriteFile CreateDirectoryW CompareFileTime LockFileEx GetFileType FindNextFileW GetVolumePathNameW SetFileInformationByHandle SetEndOfFile FindFirstFileW GetTempFileNameW GetVolumeInformationW GetFileInformationByHandle GetFinalPathNameByHandleW GetFileTime SetFilePointerEx GetFullPathNameW GetLongPathNameW

api-ms-win-core-handle-l1-1-0

GetHandleInformation SetHandleInformation CloseHandle DuplicateHandle

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetLastError SetUnhandledExceptionFilter GetErrorMode SetErrorMode RaiseException GetLastError

api-ms-win-core-processthreads-l1-1-0

InitializeProcThreadAttributeList TerminateProcess GetCurrentThread GetCurrentThreadId ExitThread GetCurrentProcess TlsFree TlsSetValue GetCurrentProcessId TlsGetValue CreateProcessW TlsAlloc ProcessIdToSessionId ExitProcess ResumeThread OpenThread GetPriorityClass SetThreadPriority GetThreadPriority SetPriorityClass DeleteProcThreadAttributeList GetExitCodeProcess GetThreadId CreateThread GetProcessTimes GetStartupInfoW UpdateProcThreadAttribute GetProcessIdOfThread SwitchToThread GetExitCodeThread GetProcessId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime GetTickCount64 GetSystemTimeAsFileTime GetWindowsDirectoryW GetTickCount GlobalMemoryStatusEx GetSystemInfo GetSystemDirectoryW

api-ms-win-core-localization-l1-2-0

FindNLSStringEx GetCPInfo LCMapStringEx EnumSystemLocalesW FormatMessageA GetOEMCP GetACP GetUserDefaultLCID LCMapStringW IsValidLocale GetLocaleInfoW IsValidCodePage GetLocaleInfoEx

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection SetEvent LeaveCriticalSection CreateEventW EnterCriticalSection WaitForSingleObject WaitForSingleObjectEx OpenMutexW InitializeCriticalSectionEx ReleaseSRWLockExclusive ReleaseMutex InitializeCriticalSectionAndSpinCount CreateMutexW OpenEventW ResetEvent TryAcquireSRWLockExclusive AcquireSRWLockExclusive

api-ms-win-core-file-l2-1-0

CreateHardLinkW CreateSymbolicLinkW MoveFileExW GetFileInformationByHandleEx

api-ms-win-core-file-l1-2-2

FindFirstStreamW FindNextStreamW AreFileApisANSI

api-ms-win-core-string-l1-1-0

CompareStringW WideCharToMultiByte CompareStringOrdinal MultiByteToWideChar GetStringTypeW

api-ms-win-core-namedpipe-l1-1-0

WaitNamedPipeW CreatePipe ConnectNamedPipe CreateNamedPipeW PeekNamedPipe

api-ms-win-core-synch-l1-2-0

InitOnceComplete Sleep WakeAllConditionVariable WakeConditionVariable InitOnceBeginInitialize SleepConditionVariableSRW

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleMode ReadConsoleW GetConsoleOutputCP SetConsoleCtrlHandler

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime GetProductInfo GetNativeSystemInfo

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW GetEnvironmentVariableA GetStdHandle ExpandEnvironmentStringsW GetCommandLineW SetStdHandle GetCommandLineA SetEnvironmentVariableW GetEnvironmentVariableW FreeEnvironmentStringsW GetCurrentDirectoryW

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort GetQueuedCompletionStatus GetOverlappedResult CancelIoEx DeviceIoControl

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy GetProcessHandleCount GetThreadTimes OpenProcess IsProcessorFeaturePresent SetProcessMitigationPolicy

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW FreeLibraryAndExitThread GetProcAddress GetModuleHandleW SetDefaultDllDirectories SizeofResource GetModuleFileNameW GetModuleHandleExW LoadLibraryExA FreeLibrary LoadResource LockResource

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects CreateSemaphoreW

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo QueryFullProcessImageNameW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-memory-l1-1-0

MapViewOfFile WriteProcessMemory ReadProcessMemory VirtualAllocEx UnmapViewOfFile VirtualProtect VirtualQuery CreateFileMappingW VirtualFree VirtualFreeEx VirtualAlloc

api-ms-win-core-job-l1-1-0

IsProcessInJob

api-ms-win-core-console-l2-1-0

SetConsoleOutputCP SetConsoleCP GenerateConsoleCtrlEvent WriteConsoleInputW

api-ms-win-core-io-l1-1-1

CancelSynchronousIo

api-ms-win-core-processthreads-l1-1-2

GetThreadIOPendingFlag IsProcessCritical

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-processthreads-l1-1-3

SetProcessInformation GetProcessInformation

api-ms-win-core-memory-l1-1-1

SetProcessWorkingSetSizeEx

api-ms-win-core-wow64-l1-1-1

IsWow64Process2

api-ms-win-core-console-l1-2-0

AttachConsole FreeConsole

api-ms-win-core-heap-l1-1-0

HeapSize GetProcessHeaps HeapReAlloc HeapAlloc HeapFree GetProcessHeap

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlPcToFileHeader RtlVirtualUnwind RtlCaptureContext

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork SubmitThreadpoolWork FreeLibraryWhenCallbackReturns CreateThreadpoolWork

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

dwmapi

DwmIsCompositionEnabled

kernel32

SetInformationJobObject QueryInformationJobObject PowerCreateRequest PowerSetRequest SetProcessAffinityMask PowerClearRequest GetNamedPipeClientProcessId AssignProcessToJobObject TerminateJobObject GetProcessIoCounters Process32FirstW HeapSummary GetActiveProcessorCount GetComputerNameW WTSGetActiveConsoleSessionId GlobalLock GlobalUnlock GetPackageFullName Module32NextW Module32FirstW EndUpdateResourceW Process32NextW Thread32Next CreateJobObjectW Thread32First BeginUpdateResourceW UpdateResourceW GetProcessAffinityMask CreateToolhelp32Snapshot

api-ms-win-core-fibers-l1-1-0

FlsSetValue FlsAlloc FlsFree FlsGetValue

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

Name

.text

Size

7.3MB

Virtual Size

7.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

418KB

Virtual Size

512KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

572KB

Virtual Size

571KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_6266a65b2e4559ca20b9861121acdbb3_amadey_glassworm_icedid_konni_luca-stealer_njrat_stealc

ntdll

bcrypt

ncrypt

crypt32

winhttp

secur32

gdiplus

ole32

oleaut32

shell32

user32

gdi32

advapi32

wtsapi32

userenv

powrprof

iphlpapi

d3d11

dxgi

imm32

version

shlwapi

wintrust

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-string-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-file-l2-1-2

api-ms-win-core-synch-l1-2-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-job-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-realtime-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-processthreads-l1-1-3

api-ms-win-core-memory-l1-1-1

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-console-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

dwmapi

kernel32

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-timezone-l1-1-0

generic