2026-11-02_c248640e03ec61d39793b9f0dd5ce876_avaddon_glassworm_icedid_luca-stealer_megazord_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_c248640e03ec61d39793b9f0dd5ce876_avaddon_glassworm_icedid_luca-stealer_megazord_njrat_stealc
Size 39.0MB
Sample261102-3jpqjsdy2w
SHA256 f6d76cd2363c6333adde2d0eef011e4d92d3cb302dbcbc9c07769a3bdb8c7f18
MD5 c248640e03ec61d39793b9f0dd5ce876
SHA1 5192c54fd94d7272d07eb50a1650410274afd131
SHA512 15c9a8e8cb158badd7f36b91e5a86d297f62d129b2cad683ca39b95686fe38202dba1edf1942e1fb800017f1c64f133550027066084897003f9fd1694d0cf09d
SSDEEP 98304:eUZsSEejQT0FBnTNZw7sQfeQVhlkY8Qr9JwS4JcZlCmECvsjyX45DA7x:eSkQF93OTWQf8QPnCmERyX4RA7
TLSH
T1EF979416B6254DA2F4A5C33CC7A12211BA603C7BDB306BE789C1774DAF7E39599B8340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_c248640e03ec61d39793b9f0dd5ce876_avaddon_glassworm_icedid_luca-stealer_megazord_njrat_stealc

File Explorer

2026-11-02_c248640e03ec61d39793b9f0dd5ce876_avaddon_glassworm_icedid_luca-stealer_megazord_njrat_stealc

.exe 39.0MB

2026-11-02_c248640e03ec61d39793b9f0dd5ce876_avaddon_glassworm_icedid_luca-stealer_megazord_njrat_stealc

IMPHASH 4f10b747de637b8f12afa222430b38ee
SHA256 f6d76cd2363c6333adde2d0eef011e4d92d3cb302dbcbc9c07769a3bdb8c7f18
MD5 c248640e03ec61d39793b9f0dd5ce876
SHA1 5192c54fd94d7272d07eb50a1650410274afd131
SHA512 15c9a8e8cb158badd7f36b91e5a86d297f62d129b2cad683ca39b95686fe38202dba1edf1942e1fb800017f1c64f133550027066084897003f9fd1694d0cf09d
SSDEEP 98304:eUZsSEejQT0FBnTNZw7sQfeQVhlkY8Qr9JwS4JcZlCmECvsjyX45DA7x:eSkQF93OTWQf8QPnCmERyX4RA7
TLSH
T1EF979416B6254DA2F4A5C33CC7A12211BA603C7BDB306BE789C1774DAF7E39599B8340
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16875428

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\netcode\newDesk\_tmp\build\windows-debug-asan\Debug\newdesk_misc_ffi_test.pdb

iphlpapi

GetAdaptersAddresses GetAdaptersInfo

ws2_32

socket setsockopt inet_pton inet_ntop ioctlsocket getsockopt htons htonl getsockname connect closesocket bind WSAIoctl WSACleanup select WSAPoll listen ntohs WSAGetLastError getaddrinfo freeaddrinfo recvfrom sendto accept WSAStartup send recv getpeername

mfplat

MFCreateAttributes MFCreateMediaType MFCreateMemoryBuffer MFStartup MFCreateDXGIDeviceManager MFCreateAlignedMemoryBuffer MFCreateSample MFTEnumEx MFShutdown MFCreateDXGISurfaceBuffer

mf

MFEnumDeviceSources

ole32

CoTaskMemFree OleUninitialize PropVariantClear CoCreateInstance CoUninitialize CoInitializeEx OleInitialize CoCreateGuid

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

mfreadwrite

MFCreateSourceReaderFromMediaSource

wtsapi32

WTSQueryUserToken

winspool.drv

DeletePrinterDriverPackageW UploadPrinterDriverPackageW EnumPrintersW OpenPrinterW AddPrinterW DeletePrinter SetPrinterW EnumPrinterDriversW DeletePrinterDriverExW ClosePrinter EnumPortsW XcvDataW InstallPrinterDriverFromPackageW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

shell32

CommandLineToArgvW ShellExecuteW ShellExecuteExW SHGetKnownFolderPath

shlwapi

ord12

advapi32

DuplicateTokenEx OpenProcessToken GetTokenInformation RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegGetValueW RegDeleteTreeW GetUserNameA RegEnumKeyExW CreateProcessAsUserW SetEntriesInAclW CheckTokenMembership RegEnumValueW ConvertSidToStringSidA SystemFunction036 SetSecurityDescriptorDacl InitializeSecurityDescriptor GetLengthSid GetAclInformation GetAce FreeSid EqualSid RegGetValueA CreateWellKnownSid AllocateAndInitializeSid SetNamedSecurityInfoW ConvertSidToStringSidW ConvertStringSidToSidW CreateProcessWithLogonW ConvertStringSecurityDescriptorToSecurityDescriptorW

kernel32

GetFileType GetDriveTypeW CreateDirectoryExW CreateHardLinkW FreeLibraryAndExitThread ExitThread GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx PssQuerySnapshot PssFreeSnapshot PssCaptureSnapshot LoadLibraryExW GetProcessId GetTempFileNameW GetEnvironmentVariableW CreateSymbolicLinkW GetExitCodeThread TryAcquireSRWLockShared RtlPcToFileHeader RaiseException GetStringTypeW EncodePointer SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetStdHandle SetEnvironmentVariableW GetConsoleMode ReadConsoleW GetConsoleOutputCP WriteConsoleW GetTimeZoneInformation SetConsoleCtrlHandler AreFileApisANSI SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetDiskFreeSpaceExW SetCurrentDirectoryW GetLocaleInfoEx FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetEndOfFile CreateDirectoryA DeleteFileA FindClose FindFirstFileA FindNextFileA RemoveDirectoryA GetTempPathA CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcessId GetExitCodeProcess CreateProcessW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetEnvironmentVariableA GetFileAttributesA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW SwitchToThread GetCurrentThreadId GetTickCount64 GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesExW GetLogicalDrives GetCurrentProcess ExitProcess GetModuleFileNameA OutputDebugStringW LoadLibraryA LocalFree CreateFileW DeleteFileW FindFirstFileW FindNextFileW FlushFileBuffers WriteFile GetTempPathW GetSystemDirectoryW GetModuleHandleW QueryPerformanceCounter GetComputerNameExA GlobalAlloc GlobalSize GlobalUnlock GlobalLock GlobalFree GetUserDefaultLocaleName GetComputerNameA ReleaseSRWLockShared AcquireSRWLockShared CreateDirectoryW CreateFileA GetFileAttributesExA ProcessIdToSessionId GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformationEx CopyFileW FindFirstFileExW GetFileAttributesW ReadFile RemoveDirectoryW SetFilePointerEx SetFileTime FormatMessageW MoveFileExW GetFileInformationByHandleEx OutputDebugStringA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FreeLibrary lstrcmpiW InitOnceExecuteOnce QueueUserAPC TerminateProcess ResumeThread VirtualAllocEx WriteProcessMemory GetModuleHandleA WTSGetActiveConsoleSessionId VerSetConditionMask OpenProcess VerifyVersionInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateProcessA CreateThread GetSystemTimeAsFileTime CreatePipe CancelIoEx InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute SetEvent CreateEventW GetThreadId ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW WaitNamedPipeW GetOverlappedResult ResetEvent GetModuleHandleExA LoadLibraryExA CreateEventA HeapAlloc HeapFree GetProcessHeap DeviceIoControl FormatMessageA CreateNamedPipeA GetStdHandle GetCommandLineA GetTempFileNameA IsDebuggerPresent DebugBreak DuplicateHandle SetErrorMode WaitForMultipleObjects GetCurrentThread OpenThread SetThreadPriority GetThreadPriority GetConsoleScreenBufferInfo SetConsoleTextAttribute QueryFullProcessImageNameW GetNamedPipeClientProcessId GetCurrentDirectoryW SetLastError VirtualAlloc VirtualProtect VirtualFree VirtualLock VirtualUnlock QueryPerformanceFrequency ReleaseSemaphore WaitForSingleObjectEx InitializeCriticalSectionEx CreateSemaphoreW SleepConditionVariableCS TryEnterCriticalSection GetNativeSystemInfo InitOnceBeginInitialize InitOnceComplete CreateSemaphoreA DecodePointer LCMapStringEx CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW IsValidCodePage GetACP GetOEMCP GetLocalTime GetTickCount GetHandleInformation CreateIoCompletionPort GetQueuedCompletionStatusEx SetFileCompletionNotificationModes PeekNamedPipe GetProcAddress InitializeSListHead

user32

CallNextHookEx GetSystemMetrics MapVirtualKeyExW SendInput VkKeyScanExW GetAsyncKeyState GetUserObjectInformationA GetThreadDesktop CloseDesktop SetThreadDesktop OpenInputDesktop GetKeyboardLayout RemoveClipboardFormatListener RegisterClipboardFormatW ChangeClipboardChain SetClipboardViewer GetClipboardOwner RegisterClassExW AddClipboardFormatListener IsClipboardFormatAvailable EmptyClipboard RegisterClipboardFormatA GetClipboardData SetClipboardData CloseClipboard OpenClipboard DestroyWindow SetWindowsHookExA RegisterClassW PostQuitMessage DefWindowProcW PostMessageW DispatchMessageW TranslateMessage GetMessageW ClipCursor SetCursorPos AllowSetForegroundWindow MapVirtualKeyW GetDoubleClickTime PostThreadMessageW GetKeyState PostThreadMessageA PeekMessageA DispatchMessageA GetMessageA LoadCursorA SetWindowPos SendMessageW EnumDisplayDevicesW EnumDisplaySettingsExW EnumDisplaySettingsW ChangeDisplaySettingsExW EnumDisplayMonitors GetMonitorInfoA FindWindowExA GetWindowRect IsWindowVisible PostMessageA ReleaseDC GetDC LockWorkStation GetWindowThreadProcessId UnhookWindowsHookEx ShowWindow CreateWindowExA RegisterClassExA DefWindowProcA GetCursorInfo GetIconInfo GetCursorPos BlockInput SetWindowLongPtrW CreateWindowExW GetWindowLongPtrW GetForegroundWindow

gdi32

CreateCompatibleDC DeleteDC GetObjectA GetDIBits GetBitmapBits GdiFlush CreateDIBSection SelectObject DeleteObject BitBlt

oleaut32

SysFreeString SysStringLen VariantClear VariantInit

clang_rt.asan_dynamic-x86_64

__asan_aligned_offset_recalloc __asan_aligned_recalloc __asan_register_globals __asan_unregister_globals __sanitizer_annotate_contiguous_container __asan_new __asan_delete_size __asan_delete_array __asan_new_nothrow __asan_new_array_nothrow __asan_delete __asan_new_array __asan_delete_array_size __asan_get_report_description __sanitizer_cov_trace_pc_guard_init__dll __sanitizer_cov_trace_pc_guard__dll __asan_aligned_offset_malloc __asan_aligned_malloc __asan_recalloc __asan_realloc __asan_calloc __asan_malloc __asan_free __asan_aligned_msize __asan_msize __sanitizer_get_ownership __asan_set_seh_filter __sanitizer_cov_trace_gep__dll __sanitizer_cov_trace_div8__dll __sanitizer_cov_trace_div4__dll __sanitizer_cov_trace_const_cmp8__dll __sanitizer_cov_trace_const_cmp4__dll __sanitizer_cov_trace_const_cmp2__dll __sanitizer_cov_trace_const_cmp1__dll __sanitizer_cov_trace_cmp8__dll __sanitizer_cov_trace_cmp4__dll __asan_get_shadow_memory_dynamic_address __sanitizer_cov_trace_cmp1__dll __sanitizer_cov_trace_cmp__dll __sancov_default_options__dll __sanitizer_ignore_free_hook__dll __sanitizer_malloc_hook__dll __asan_should_detect_stack_use_after_return __asan_on_error__dll __asan_default_suppressions__dll __asan_default_options__dll __asan_wrap_wcsnlen __asan_set_error_report_callback __asan_wrap_strtoll_static __asan_wrap_strtol_static __asan_wrap_strtok __asan_wrap_strspn __asan_wrap_strpbrk __sanitizer_free_hook__dll __sanitizer_weak_hook_strstr__dll __asan_aligned_realloc __sanitizer_weak_hook_strcmp__dll __sanitizer_weak_hook_memcmp__dll __sanitizer_get_dtls_size__dll __sanitizer_sandbox_on_notify__dll __sanitizer_report_error_summary__dll __sanitizer_on_print__dll __sanitizer_register_weak_function __sanitizer_override_function __asan_wrap_wcslen __asan_wrap_strlen __asan_wrap_memcmp __asan_wrap_memchr __asan_storeN __asan_store8 __asan_store4 __asan_store2 __asan_store16 __asan_store1 __asan_set_shadow_f8 __asan_set_shadow_00 __asan_report_store8 __asan_report_store4 __asan_report_store2 __asan_report_store16 __asan_report_store1 __asan_report_load8 __asan_report_load4 __asan_report_load2 __asan_report_load16 __asan_report_load1 __asan_memset __asan_memcpy __asan_loadN __asan_load8 __asan_load4 __asan_load2 __asan_load16 __asan_load1 __asan_wrap_strnlen __asan_wrap_wcsncpy __asan_wrap_strncpy __asan_wrap_strncmp __asan_wrap_wcsncat __asan_wrap_strncat __asan_wrap__strdup __asan_wrap_strcspn __asan_wrap_wcscpy __asan_wrap_strcpy __asan_wrap_strcmp __asan_wrap_wcscat __asan_wrap_strcat __asan_wrap_frexp __asan_wrap_atoll_static __asan_wrap_atoi_static __asan_wrap_atol_static __sanitizer_cov_pcs_cleanup__dll __asan_aligned_offset_realloc __sanitizer_weak_hook_strncmp__dll __sanitizer_cov_pcs_init__dll __sanitizer_cov_bool_flag_init__dll __sanitizer_cov_8bit_counters_cleanup__dll __sanitizer_cov_8bit_counters_init__dll __sanitizer_cov_trace_switch__dll __sanitizer_cov_store16__dll __sanitizer_cov_store8__dll __sanitizer_cov_store4__dll __sanitizer_cov_store2__dll __sanitizer_cov_store1__dll __sanitizer_cov_load16__dll __sanitizer_cov_load8__dll __sanitizer_cov_load4__dll __asan_aligned_free __sanitizer_cov_load2__dll __sanitizer_cov_load1__dll __sanitizer_cov_trace_pc_indir__dll __sanitizer_cov_trace_cmp2__dll __sanitizer_cov_trace_pc_guard_cleanup__dll

powrprof

CallNtPowerInformation

winhttp

WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpReadData WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpOpen

secur32

FreeContextBuffer DecryptMessage QueryContextAttributesA DeleteSecurityContext CompleteAuthToken AcceptSecurityContext InitializeSecurityContextA FreeCredentialsHandle EncryptMessage AcquireCredentialsHandleA

crypt32

CertCloseStore CertOpenStore CertFindCertificateInStore

pdh

PdhGetFormattedCounterValue PdhCloseQuery PdhCollectQueryData PdhOpenQueryA PdhCollectQueryDataEx PdhAddEnglishCounterA

Name

.text

Size

18.2MB

Virtual Size

18.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.4MB

Virtual Size

7.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11.6MB

Virtual Size

30.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

683KB

Virtual Size

682KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.WEAK

Size

512B

Virtual Size

392B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.INTR

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_c248640e03ec61d39793b9f0dd5ce876_avaddon_glassworm_icedid_luca-stealer_megazord_njrat_stealc

iphlpapi

ws2_32

mfplat

mf

ole32

d3d11

dxgi

mfreadwrite

wtsapi32

winspool.drv

userenv

shell32

shlwapi

advapi32

kernel32

user32

gdi32

oleaut32

clang_rt.asan_dynamic-x86_64

powrprof

winhttp

secur32

crypt32

pdh

generic