2026-10-28_1083b8c93ab0b1295e6c5f9da0f61ed2_glassworm_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_1083b8c93ab0b1295e6c5f9da0f61ed2_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 5.4MB
Sample261030-l9d83abt21
SHA256 471f1b120cf847edfa2a498b668da2f7b1691e0f0b4fad03696bd09be6c54297
MD5 1083b8c93ab0b1295e6c5f9da0f61ed2
SHA1 ecb36ae444f28c011bc15d4bf1c594c0150f0aa6
SHA512 8cdb4118e8be6eb7e95263f8957de66f805cfb78e0e4b6be7a7ebf7ab67e5757ca07403c5af4a5597930c96a1b40e4dd28c262ec51b7ff99e6c059db55d25882
SSDEEP 49152:6cSVaAYL94bURO7zN+sgPH4+HtADVFu3TQptL:6zVUnd5Cd
TLSH
T11246E75ADA7651E1D4FAD0798627B227FC713C9EC230A7079B41AB175B32760EA3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_1083b8c93ab0b1295e6c5f9da0f61ed2_glassworm_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-10-28_1083b8c93ab0b1295e6c5f9da0f61ed2_glassworm_icedid_luca-stealer_njrat_stealc_vidar

.exe 5.4MB

2026-10-28_1083b8c93ab0b1295e6c5f9da0f61ed2_glassworm_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 7cee4c17bcde90d7ce4358b2489fe091
SHA256 471f1b120cf847edfa2a498b668da2f7b1691e0f0b4fad03696bd09be6c54297
MD5 1083b8c93ab0b1295e6c5f9da0f61ed2
SHA1 ecb36ae444f28c011bc15d4bf1c594c0150f0aa6
SHA512 8cdb4118e8be6eb7e95263f8957de66f805cfb78e0e4b6be7a7ebf7ab67e5757ca07403c5af4a5597930c96a1b40e4dd28c262ec51b7ff99e6c059db55d25882
SSDEEP 49152:6cSVaAYL94bURO7zN+sgPH4+HtADVFu3TQptL:6zVUnd5Cd
TLSH
T11246E75ADA7651E1D4FAD0798627B227FC713C9EC230A7079B41AB175B32760EA3E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3488328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2046_D20260529T134211\fa_rss\Release\PCAppStore.pdb

urlmon

URLDownloadToFileW CreateUri

ws2_32

shutdown WSAGetLastError WSAStartup closesocket recv send WSACleanup socket WSAConnectByNameW

winhttp

WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpSetOption WinHttpReadData WinHttpQueryHeaders

wininet

InternetConnectW InternetCloseHandle HttpSendRequestW HttpQueryInfoW InternetOpenW InternetQueryDataAvailable HttpOpenRequestW InternetSetOptionW InternetReadFile HttpAddRequestHeadersW

secur32

ApplyControlToken InitializeSecurityContextW DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW DeleteSecurityContext EncryptMessage FreeContextBuffer

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

shlwapi

PathFindFileNameW PathCreateFromUrlW PathAddBackslashW UrlCreateFromPathW AssocCreate SHCreateStreamOnFileEx PathRenameExtensionW

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

msi

ord70 ord45 ord32 ord118 ord8 ord160 ord92 ord159

kernel32

InterlockedPushEntrySList LCMapStringEx CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind CreateThread RtlUnwindEx RtlPcToFileHeader WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle ReadConsoleW SetFilePointerEx GetFileSizeEx DeleteFileW IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW WideCharToMultiByte LoadResource LockResource SizeofResource FindResourceW SetEnvironmentVariableW SetEvent ResetEvent CreateEventW Sleep WaitForMultipleObjects GetModuleFileNameW CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW CreateMutexW ExpandEnvironmentStringsW GetEnvironmentVariableW GetTickCount64 SetCurrentDirectoryW ReadFile CreateProcessW GetLocaleInfoEx GetConsoleOutputCP CopyFileA OpenProcess IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetStdHandle GetEnvironmentVariableA FindClose FindFirstFileW GetCurrentProcess FreeLibrary LoadLibraryW IsProcessorFeaturePresent FileTimeToLocalFileTime LocalFree lstrcmpA FileTimeToSystemTime FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact GetSystemInfo HeapReAlloc DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock GlobalFree LoadLibraryExW CreateDirectoryW FindFirstFileExW FindNextFileW RemoveDirectoryW GetUserDefaultUILanguage LCIDToLocaleName VerSetConditionMask VerifyVersionInfoW GetSystemFirmwareTable GetCommandLineW OpenFileMappingW OpenMutexW GetUserDefaultLocaleName GetCurrentThread GetNativeSystemInfo Module32FirstW GlobalMemoryStatusEx Module32NextW GetProcessTimes SetUnhandledExceptionFilter FreeEnvironmentStringsW K32GetModuleBaseNameW K32EnumProcessModules GetEnvironmentStringsW ExitThread FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType EncodePointer SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable QueryPerformanceFrequency GetStartupInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetSystemTime PeekNamedPipe SystemTimeToTzSpecificLocalTime FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode RtlCaptureContext InitializeSListHead InitOnceComplete InitOnceBeginInitialize GetStringTypeW GetFileInformationByHandleEx RaiseException GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive TerminateProcess GetCurrentDirectoryW GetFileInformationByHandle SystemTimeToFileTime SetFileInformationByHandle

user32

GetForegroundWindow keybd_event GetShellWindow GetCursorPos SetCursorPos GetWindowTextW FindWindowExW GetMessageW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow BeginPaint EndPaint InvalidateRect EqualRect GetWindow SetWindowPos WindowFromPoint GetPhysicalCursorPos CloseClipboard GetAsyncKeyState GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors EnumWindows FindWindowW IntersectRect LoadCursorW MonitorFromRect MonitorFromPoint GetWindowThreadProcessId GetClassNameW OpenClipboard SetClassLongPtrW PtInRect ScreenToClient SetCapture GetCapture TrackMouseEvent ChangeWindowMessageFilterEx ReleaseDC GetDC SendInput EndDialog IsWindowVisible DialogBoxParamW SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer SetForegroundWindow SetFocus IsIconic ShowWindow IsWindow GetWindowRect ReleaseCapture PostMessageW LoadIconW TrackPopupMenu RemoveMenu AppendMenuW InsertMenuW GetMenuItemCount DestroyMenu MonitorFromWindow UnregisterClassW GetWindowPlacement IsZoomed SetWindowTextW GetClientRect AdjustWindowRectEx MapWindowPoints UnhookWinEvent FillRect SetWindowLongW SendMessageW CreatePopupMenu SetWindowLongPtrW SetWindowPlacement OpenIcon EmptyClipboard GetMonitorInfoW SetClipboardData GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW UpdateWindow GetDpiForWindow GetSystemMetrics GetWindowLongPtrW SetRectEmpty

gdi32

DeleteObject SelectObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateSolidBrush

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

RegCreateKeyExW RegNotifyChangeKeyValue GetUserNameW RegGetValueW EventUnregister RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW EventRegister EventSetInformation EventWriteTransfer

shell32

ShellExecuteW SHAppBarMessage SHGetKnownFolderPath SHQueryRecycleBinW SHEmptyRecycleBinW SHGetFolderPathW ShellExecuteExW CommandLineToArgvW Shell_NotifyIconW

ole32

CoCreateInstance RegisterDragDrop CoInitializeSecurity CoTaskMemFree CoUninitialize CoInitialize OleRun OleUninitialize CoSetProxyBlanket CreateStreamOnHGlobal CoTaskMemAlloc RevokeDragDrop CoAllowSetForegroundWindow OleInitialize CoCreateFreeThreadedMarshaler CoInitializeEx

oleaut32

VariantInit VariantChangeType SysStringLen VariantClear SysFreeString GetErrorInfo SetErrorInfo SysAllocString

iphlpapi

IcmpCreateFile IcmpCloseHandle

crypt32

CryptDecodeObjectEx CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CertCloseStore CertOpenStore CryptDecodeObject CryptMsgOpenToDecode CryptMsgClose CryptMsgUpdate CryptMsgGetParam

ext-ms-win-networking-wlanapi-l1-1-0

WlanFreeMemory WlanGetAvailableNetworkList WlanEnumInterfaces WlanOpenHandle WlanCloseHandle

wlanapi

WlanAllocateMemory WlanRegisterNotification WlanScan

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptOpenAlgorithmProvider BCryptGenRandom BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

gdiplus

GdipCloneImage GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDeleteMatrix GdipCreateMatrix GdipFree GdipAlloc GdipCreateBitmapFromHBITMAP GdiplusStartup GdipFlush GdipDrawImageI GdipCreateFromHDC GdipDisposeImage GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdiplusShutdown GdipFillEllipse GdipSetStringFormatAlign

setupapi

SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

dbghelp

SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 SymInitialize SymCleanup StackWalk64 SymSetOptions SymFromAddr

version

GetFileVersionInfoSizeW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

894KB

Virtual Size

894KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

191KB

Virtual Size

325KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

215KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

313KB

Virtual Size

313KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_1083b8c93ab0b1295e6c5f9da0f61ed2_glassworm_icedid_luca-stealer_njrat_stealc_vidar

urlmon

ws2_32

winhttp

wininet

secur32

wtsapi32

shlwapi

dwmapi

api-ms-win-shcore-scaling-l1-1-1

msi

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

crypt32

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

bcrypt

api-ms-win-core-version-l1-1-0

api-ms-win-core-version-l1-1-1

gdiplus

setupapi

dbghelp

version

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic