2026-11-01_9d930635fd8fbe94831bcdd9a988bfdc_amadey_glassworm_icedid_konni_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_9d930635fd8fbe94831bcdd9a988bfdc_amadey_glassworm_icedid_konni_luca-stealer_njrat_stealc
Size 16.4MB
Sample261102-qs3ybatybw
SHA256 e2025ef3ff6183c1ee984ed8a9c7100d998b881c7571fbb6359da125d279b5c6
MD5 9d930635fd8fbe94831bcdd9a988bfdc
SHA1 0580cf027b6c9f4f59d4fa0e0861a323ded84814
SHA512 29697bd333c73882369629432a8ccd84e93fc4653488ca7a610f483b0bc6aab305146b08b75920525af331169fe8c07714d5167e402d3aa91b3b500971c546b6
SSDEEP 98304:NYJYjw5ld+eHA6FIOgmHM4ivDIfQgGD5BuqBVsR3uHycJz8xnTT+IcFa:aJmKweHjF5cvDIoBDXuGqu21+U
TLSH
T11807C50EAB6582E1D0B6D078C583652BFD7138AAC33467E796429F172F167E1E83DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_9d930635fd8fbe94831bcdd9a988bfdc_amadey_glassworm_icedid_konni_luca-stealer_njrat_stealc

File Explorer

2026-11-01_9d930635fd8fbe94831bcdd9a988bfdc_amadey_glassworm_icedid_konni_luca-stealer_njrat_stealc

.exe 16.4MB

2026-11-01_9d930635fd8fbe94831bcdd9a988bfdc_amadey_glassworm_icedid_konni_luca-stealer_njrat_stealc

IMPHASH c4c638e936897566fe65bac326e82784
SHA256 e2025ef3ff6183c1ee984ed8a9c7100d998b881c7571fbb6359da125d279b5c6
MD5 9d930635fd8fbe94831bcdd9a988bfdc
SHA1 0580cf027b6c9f4f59d4fa0e0861a323ded84814
SHA512 29697bd333c73882369629432a8ccd84e93fc4653488ca7a610f483b0bc6aab305146b08b75920525af331169fe8c07714d5167e402d3aa91b3b500971c546b6
SSDEEP 98304:NYJYjw5ld+eHA6FIOgmHM4ivDIfQgGD5BuqBVsR3uHycJz8xnTT+IcFa:aJmKweHjF5cvDIoBDXuGqu21+U
TLSH
T11807C50EAB6582E1D0B6D078C583652BFD7138AAC33467E796429F172F167E1E83DB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8577656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

NtCreateFile RtlUnwindEx RtlUnwind

vssapi

CreateVssBackupComponentsInternal VssFreeSnapshotPropertiesInternal

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGetProperty BCryptGenRandom BCryptHash BCryptGenerateSymmetricKey BCryptEncrypt BCryptDecrypt BCryptFinishHash BCryptVerifySignature BCryptImportKeyPair BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptHashData BCryptCreateHash BCryptDestroyKey

ncrypt

NCryptOpenKey NCryptOpenStorageProvider NCryptFreeObject NCryptCreatePersistedKey NCryptSetProperty NCryptFinalizeKey NCryptExportKey NCryptSignHash NCryptDeleteKey

crypt32

CertCreateCertificateContext CertGetNameStringW CryptEncodeObjectEx CertVerifyTimeValidity CryptBinaryToStringA CryptStringToBinaryA CertFreeCertificateContext

winhttp

WinHttpQueryOption WinHttpQueryDataAvailable WinHttpWriteData WinHttpReadData WinHttpSetTimeouts WinHttpCloseHandle WinHttpOpen WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSetOption WinHttpConnect

secur32

GetUserNameExW FreeCredentialsHandle InitializeSecurityContextA DeleteSecurityContext ApplyControlToken QueryContextAttributesA FreeContextBuffer EncryptMessage DecryptMessage AcquireCredentialsHandleA

gdiplus

GdipCreateBitmapFromScan0 GdipDisposeImage GdiplusStartup GdipDrawImageRectI GdipGetImageEncodersSize GdipGetImageEncoders GdipGetImageGraphicsContext GdipSaveImageToStream GdipSetInterpolationMode GdipDeleteGraphics GdipCloneImage GdipAlloc GdiplusShutdown GdipFree

ole32

CoInitializeSecurity StringFromGUID2 CoCreateGuid GetHGlobalFromStream CoInitializeEx CoUninitialize CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance

oleaut32

SysStringLen SysFreeString VariantInit

shell32

ord155 SHGetKnownFolderPath CommandLineToArgvW ord152 SHGetPathFromIDListW SHGetDesktopFolder ExtractIconExW

user32

IsWindow IsWindowVisible IsIconic IsZoomed GetClipboardSequenceNumber MapVirtualKeyExW IsWindowEnabled GetMenu GetMenuState GetSubMenu GetMenuItemInfoW GetMenuItemRect MenuItemFromPoint RedrawWindow SetPropW GetPropW RemovePropW GetWindowRect ClientToScreen ScreenToClient GetClassLongPtrW GetParent GetClassNameW GetTopWindow GetWindow GetAncestor OpenDesktopW GetMessageW PostQuitMessage RegisterClassW ShowWindow GetWindowTextW MsgWaitForMultipleObjects DestroyIcon PeekMessageW ShowWindowAsync GetLastInputInfo GetWindowTextLengthW SystemParametersInfoW EnumDesktopsW EnumDisplaySettingsW IsHungAppWindow PrintWindow MoveWindow SetWindowTextW GetGuiResources MonitorFromPoint InflateRect GetWindowPlacement SetWindowPlacement IsImmersiveProcess GetIconInfo OpenClipboard CloseClipboard PostMessageW SetClipboardData GetClipboardData RegisterClipboardFormatW EnumClipboardFormats GetClipboardFormatNameW EmptyClipboard SetTimer DispatchMessageW TranslateMessage MessageBoxW GetGUIThreadInfo GetWindowThreadProcessId GetForegroundWindow GetSystemMetrics MapVirtualKeyW DestroyWindow CreateWindowExW SendMessageTimeoutW EnumDisplayDevicesW FillRect CreateIconIndirect DestroyCursor CreateCursor ReleaseDC GetDC GetProcessWindowStation GetThreadDesktop MonitorFromRect DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes EnumDisplaySettingsExW EqualRect GetUserObjectInformationW CloseDesktop SetThreadDesktop OpenInputDesktop SendInput GetCursorInfo PtInRect CharUpperBuffW GetClientRect InvalidateRect EndPaint BeginPaint UpdateWindow DrawTextW SetWindowPos RegisterClassExW PostThreadMessageW CallNextHookEx SetThreadDpiAwarenessContext UnhookWindowsHookEx SetWindowsHookExW GetDoubleClickTime EnumDesktopWindows GetKeyboardLayout CreateDesktopW GetDpiForWindow EnumDisplayMonitors GetMonitorInfoW LoadCursorW SetWindowLongPtrW GetClipboardOwner GetWindowLongPtrW MonitorFromWindow MsgWaitForMultipleObjectsEx DefWindowProcW DrawIconEx

gdi32

GetStockObject SetBkMode SetTextColor CreateFontW CreateSolidBrush CreateCompatibleBitmap GetPixel PatBlt CreateBitmap GdiFlush SetBrushOrgEx CreateDIBSection GetDIBits GetObjectW StretchBlt TextOutW SelectObject SetStretchBltMode DeleteObject BitBlt CreateCompatibleDC DeleteDC

advapi32

CheckTokenMembership OpenThreadToken OpenProcessToken GetTokenInformation LookupAccountSidW CreateProcessAsUserW DuplicateTokenEx GetAclInformation GetSecurityDescriptorControl GetUserNameW ConvertSecurityDescriptorToStringSecurityDescriptorW GetSecurityDescriptorOwner RegOpenCurrentUser RegDeleteTreeW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW CreateRestrictedToken ImpersonateLoggedOnUser RevertToSelf GetSecurityInfo ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW AdjustTokenPrivileges GetAce ChangeServiceConfigW GetSecurityDescriptorDacl CloseServiceHandle SetTokenInformation LookupPrivilegeValueW RegCloseKey EnumServicesStatusExW OpenSCManagerW OpenServiceW QueryServiceConfigW RegEnumKeyExW IsValidSid RegOpenKeyExW RegQueryInfoKeyW RegGetValueW GetSidSubAuthorityCount GetSidSubAuthority SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAce ConvertSidToStringSidA CopySid IsWellKnownSid GetLengthSid InitializeAcl SetThreadToken SetSecurityInfo RegLoadAppKeyW QueryServiceStatusEx RegSetValueExW RegDeleteKeyExW RegCreateKeyExW RegQueryValueExW RegEnumValueW EqualSid CreateWellKnownSid LookupAccountNameW

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQuerySessionInformationW WTSQueryUserToken

userenv

DestroyEnvironmentBlock GetUserProfileDirectoryW CreateEnvironmentBlock

powrprof

PowerSettingUnregisterNotification PowerSettingRegisterNotification

iphlpapi

CancelMibChangeNotify2 NotifyIpInterfaceChange

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

imm32

ImmGetDefaultIMEWnd

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW GetFileVersionInfoExW GetFileVersionInfoSizeExW

shlwapi

StrRetToBufW

wintrust

CryptCATAdminAcquireContext2 CryptCATAdminEnumCatalogFromHash WTHelperGetProvSignerFromChain WinVerifyTrust CryptCATAdminCalcHashFromFileHandle2 WTHelperProvDataFromStateData CryptCATAdminReleaseContext CryptCATCatalogInfoFromContext CryptCATAdminReleaseCatalogContext

api-ms-win-core-file-l1-1-0

GetFileAttributesW RemoveDirectoryW SetFileAttributesW SetFileTime GetShortPathNameW GetDiskFreeSpaceExW GetLogicalDriveStringsW DeleteFileW FindClose GetDriveTypeW GetVolumeInformationByHandleW WriteFile ReadFile GetFileSizeEx GetFileTime CreateFileW GetFullPathNameW GetFileType SetEndOfFile UnlockFileEx LockFileEx FindFirstFileW GetFinalPathNameByHandleW FindNextFileW FindFirstFileExW GetFileAttributesExW FlushFileBuffers GetVolumeInformationW SetFilePointerEx GetLongPathNameW GetVolumePathNameW SetFileInformationByHandle GetFileInformationByHandle CompareFileTime CreateDirectoryW

api-ms-win-core-handle-l1-1-0

CloseHandle GetHandleInformation SetHandleInformation DuplicateHandle CompareObjectHandles

api-ms-win-core-errorhandling-l1-1-0

RaiseException SetUnhandledExceptionFilter GetErrorMode SetErrorMode UnhandledExceptionFilter GetLastError SetLastError

api-ms-win-core-processthreads-l1-1-0

GetProcessTimes InitializeProcThreadAttributeList CreateProcessW ProcessIdToSessionId OpenThread SuspendThread ResumeThread ExitProcess DeleteProcThreadAttributeList TerminateProcess ExitThread SetThreadPriority GetThreadPriority TlsFree GetPriorityClass SetPriorityClass GetCurrentProcess GetExitCodeProcess GetThreadId CreateThread GetStartupInfoW GetProcessIdOfThread SwitchToThread TlsSetValue TlsGetValue GetCurrentThread GetProcessId GetExitCodeThread GetCurrentThreadId UpdateProcThreadAttribute TlsAlloc GetCurrentProcessId

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64 GetSystemDirectoryW GetTickCount GetSystemTime GetWindowsDirectoryW GetSystemTimeAsFileTime GlobalMemoryStatusEx GetSystemInfo

api-ms-win-core-localization-l1-2-0

IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetCPInfo LCMapStringEx GetLocaleInfoEx FormatMessageA GetACP FindNLSStringEx LCMapStringW GetLocaleInfoW GetOEMCP

api-ms-win-core-synch-l1-1-0

SetEvent OpenEventW ResetEvent CreateEventW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection OpenMutexW EnterCriticalSection InitializeCriticalSectionEx ReleaseMutex InitializeCriticalSectionAndSpinCount TryAcquireSRWLockExclusive CreateMutexW WaitForSingleObjectEx AcquireSRWLockExclusive ReleaseSRWLockExclusive

api-ms-win-core-file-l2-1-0

CreateSymbolicLinkW CreateHardLinkW MoveFileExW GetFileInformationByHandleEx

api-ms-win-core-file-l1-2-2

FindFirstStreamW AreFileApisANSI FindNextStreamW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar GetStringTypeW CompareStringW WideCharToMultiByte CompareStringOrdinal

api-ms-win-core-namedpipe-l1-1-0

CreateNamedPipeW ConnectNamedPipe PeekNamedPipe WaitNamedPipeW CreatePipe

api-ms-win-core-synch-l1-2-0

Sleep WakeConditionVariable SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler GetConsoleMode ReadConsoleW GetConsoleOutputCP WriteConsoleW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo GetSystemTimePreciseAsFileTime GetNativeSystemInfo

api-ms-win-core-heap-l2-1-0

GlobalFree LocalFree GlobalAlloc

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle GetCommandLineA FreeEnvironmentStringsW GetEnvironmentVariableA SetEnvironmentVariableW GetCommandLineW SetStdHandle GetCurrentDirectoryW ExpandEnvironmentStringsW GetEnvironmentStringsW GetEnvironmentVariableW

api-ms-win-core-io-l1-1-0

GetQueuedCompletionStatus CreateIoCompletionPort GetOverlappedResult DeviceIoControl CancelIoEx

api-ms-win-core-processthreads-l1-1-1

GetThreadTimes GetProcessMitigationPolicy OpenProcess IsProcessorFeaturePresent SetProcessMitigationPolicy GetProcessHandleCount

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW GetProcAddress GetModuleHandleW FreeLibrary GetModuleFileNameW LoadLibraryExA FreeLibraryAndExitThread LockResource SizeofResource LoadResource GetModuleHandleExW SetDefaultDllDirectories

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-psapi-l1-1-0

K32GetProcessMemoryInfo QueryFullProcessImageNameW

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW WaitForMultipleObjects

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-memory-l1-1-0

VirtualAlloc VirtualProtect CreateFileMappingW VirtualQuery VirtualFree UnmapViewOfFile MapViewOfFile VirtualFreeEx WriteProcessMemory ReadProcessMemory VirtualAllocEx

api-ms-win-core-job-l1-1-0

IsProcessInJob

api-ms-win-core-console-l2-1-0

WriteConsoleInputW GenerateConsoleCtrlEvent SetConsoleOutputCP SetConsoleCP

api-ms-win-core-io-l1-1-1

CancelSynchronousIo

api-ms-win-core-processthreads-l1-1-2

IsProcessCritical GetThreadIOPendingFlag

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-processthreads-l1-1-3

GetProcessInformation SetProcessInformation

api-ms-win-core-memory-l1-1-1

SetProcessWorkingSetSizeEx

api-ms-win-core-wow64-l1-1-1

IsWow64Process2

api-ms-win-core-console-l1-2-0

AttachConsole FreeConsole

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapQueryInformation GetProcessHeaps

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlVirtualUnwind

api-ms-win-core-threadpool-l1-2-0

FreeLibraryWhenCallbackReturns CloseThreadpoolWork CreateThreadpoolWork SubmitThreadpoolWork

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

rstrtmgr

RmEndSession RmGetList RmRegisterResources RmStartSession

dwmapi

DwmIsCompositionEnabled

kernel32

GlobalSize WTSGetActiveConsoleSessionId GetComputerNameW GlobalUnlock HeapSummary Process32NextW Process32FirstW GetPackageFullName SetProcessAffinityMask GlobalLock Module32FirstW GetActiveProcessorCount Thread32Next GetProcessAffinityMask Thread32First CreateToolhelp32Snapshot CreateJobObjectW SetInformationJobObject QueryInformationJobObject PowerCreateRequest PowerSetRequest PowerClearRequest GetNamedPipeClientProcessId AssignProcessToJobObject TerminateJobObject MoveFileW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW Module32NextW GetProcessIoCounters

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsGetValue FlsSetValue FlsFree

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

Name

.text

Size

9.3MB

Virtual Size

9.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

488KB

Virtual Size

585KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

714KB

Virtual Size

714KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_9d930635fd8fbe94831bcdd9a988bfdc_amadey_glassworm_icedid_konni_luca-stealer_njrat_stealc

ntdll

vssapi

bcrypt

ncrypt

crypt32

winhttp

secur32

gdiplus

ole32

oleaut32

shell32

user32

gdi32

advapi32

wtsapi32

userenv

powrprof

iphlpapi

d3d11

dxgi

imm32

version

shlwapi

wintrust

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-string-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-file-l2-1-2

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-file-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-job-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-realtime-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-processthreads-l1-1-3

api-ms-win-core-memory-l1-1-1

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-console-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

rstrtmgr

dwmapi

kernel32

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-timezone-l1-1-0

generic