2026-11-01_82c451539f8190b650b72910de477f9f_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_82c451539f8190b650b72910de477f9f_glassworm_icedid_luca-stealer_njrat_stealc
Size 1.7MB
Sample261102-ttrs8abv2x
SHA256 fe63fccfee31ffe949cb89f959d927f598a3825b9febda59f60971cd7fa74d49
MD5 82c451539f8190b650b72910de477f9f
SHA1 47ed23b0dcc306f579b00deb6bb73fac281a91f2
SHA512 a65a8279e18eddb559ef7a41ef03943ff67c5cf8ddf070fb3b3d04cb7643decc2ffaab37e8453a029d3bfd00d6bcbb20ab6ba053dfbb6bbfbc80abe3382eeb29
SSDEEP 24576:lFVBW88Zfaf6im6zeCVjeKpblI4Jb7MEcv+BxYjFkOiDnFtxgnaAYEh8z:lFV88W46iZlbI4JbohxxkHDnMaNz
TLSH
T141859E06A2E801ECE0BBD179D9466917EB7278190F705ADF13D0469A1FB36E05E7E313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_82c451539f8190b650b72910de477f9f_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-01_82c451539f8190b650b72910de477f9f_glassworm_icedid_luca-stealer_njrat_stealc

.exe 1.7MB

2026-11-01_82c451539f8190b650b72910de477f9f_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 235bd812c97773ec8babd7fce6923803
SHA256 fe63fccfee31ffe949cb89f959d927f598a3825b9febda59f60971cd7fa74d49
MD5 82c451539f8190b650b72910de477f9f
SHA1 47ed23b0dcc306f579b00deb6bb73fac281a91f2
SHA512 a65a8279e18eddb559ef7a41ef03943ff67c5cf8ddf070fb3b3d04cb7643decc2ffaab37e8453a029d3bfd00d6bcbb20ab6ba053dfbb6bbfbc80abe3382eeb29
SSDEEP 24576:lFVBW88Zfaf6im6zeCVjeKpblI4Jb7MEcv+BxYjFkOiDnFtxgnaAYEh8z:lFV88W46iZlbI4JbohxxkHDnMaNz
TLSH
T141859E06A2E801ECE0BBD179D9466917EB7278190F705ADF13D0469A1FB36E05E7E313
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

943248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

setupapi

CM_Get_Device_IDW CM_Get_Parent SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces SetupDiOpenDevRegKey SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo

hid

HidD_GetSerialNumberString HidD_GetProductString HidD_GetManufacturerString

user32

DispatchMessageW PeekMessageW SetProcessDPIAware PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW TranslateMessage GetMessageW EnumDisplaySettingsW DefWindowProcW PostMessageW MessageBoxW DestroyWindow ShowWindow SetLayeredWindowAttributes SetWindowPos IsIconic MsgWaitForMultipleObjects SetTimer KillTimer GetSystemMetrics UpdateWindow SetWindowRgn GetClientRect GetWindowRect ScreenToClient GetWindowLongPtrW SetWindowLongPtrW LoadIconW LoadImageW MonitorFromWindow GetMonitorInfoW MessageBoxA GetRawInputDeviceList GetRawInputDeviceInfoW RegisterRawInputDevices GetRawInputData CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastInputInfo PostThreadMessageW EnumDisplayMonitors GetMonitorInfoA LoadCursorA SetWindowLongPtrA SetWindowLongW SetWindowLongA GetWindowLongW WindowFromPoint ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetPropA SetPropA ReleaseDC GetDC SetForegroundWindow GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState SetFocus BringWindowToTop IsChild GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatusEx CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegEnumKeyExW RegEnumValueW RegGetValueW OpenProcessToken AdjustTokenPrivileges GetTokenInformation LookupPrivilegeValueA

iphlpapi

GetExtendedTcpTable GetExtendedUdpTable

ws2_32

ntohs

tbs

Tbsi_GetDeviceInfo

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain CryptCATCatalogInfoFromContext CryptCATAdminCalcHashFromFileHandle WinVerifyTrust CryptCATAdminAcquireContext CryptCATAdminReleaseContext CryptCATAdminReleaseCatalogContext CryptCATAdminEnumCatalogFromHash

crypt32

CertGetNameStringW CertEnumCertificatesInStore CertCloseStore CryptUnprotectData CertOpenSystemStoreW CryptProtectData

wevtapi

EvtQuery EvtRender EvtNext EvtClose

kernel32

ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext FreeLibraryAndExitThread GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WakeAllConditionVariable GetStdHandle HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetModuleHandleExW GetFileSizeEx GetFileInformationByHandleEx AreFileApisANSI SetFilePointerEx ReadConsoleW HeapReAlloc GetTimeZoneInformation SetStdHandle IsValidCodePage FindFirstFileExW ExitProcess GetProcAddress LoadLibraryW GlobalSize GlobalUnlock GlobalLock WideCharToMultiByte CreateFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileAttributesExW CloseHandle GetLastError DeviceIoControl GetProcessTimes OpenProcess GetSystemTime GetSystemTimeAsFileTime GetTickCount64 GetSystemDirectoryW GetWindowsDirectoryW GetModuleHandleW SystemTimeToFileTime ReadFile QueryPerformanceCounter QueryPerformanceFrequency Sleep GetSystemWindowsDirectoryW GetSystemFirmwareTable GetModuleFileNameW QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW CreateDirectoryW DeleteFileW WriteFile GetCurrentProcess SetProcessWorkingSetSize GetModuleHandleA LocalFree MoveFileW OutputDebugStringA GlobalAlloc GlobalFree MultiByteToWideChar VerSetConditionMask RtlUnwind LoadLibraryA GetLocaleInfoA IsDBCSLeadByte GetEnvironmentVariableW GetCurrentThreadId GetLocalTime GetTickCount SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateFileA ExpandEnvironmentStringsW SearchPathW GetLogicalDriveStringsW QueryDosDeviceW GetFirmwareEnvironmentVariableW SetLastError GetCurrentThread K32GetModuleInformation GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetEndOfFile GetLocaleInfoEx GetStringTypeW FormatMessageA SleepConditionVariableSRW AcquireSRWLockShared ReleaseSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread WaitForSingleObjectEx GetFileType HeapSize WriteConsoleW LoadLibraryExW FreeLibrary

gdi32

CreateCompatibleDC DeleteDC SelectObject CreateRoundRectRgn DeleteObject GetDeviceCaps CreateCompatibleBitmap BitBlt

shell32

ShellExecuteExW SHGetKnownFolderPath ShellExecuteW SHGetFolderPathW

ole32

CoInitializeEx CoUninitialize CoTaskMemFree GetHGlobalFromStream CreateStreamOnHGlobal CoCreateInstance CoSetProxyBlanket

oleaut32

SysAllocString SysFreeString VariantClear

gdiplus

GdipGetImageEncoders GdiplusStartup GdipFree GdipAlloc GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToStream

imm32

ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow ImmGetContext

xinput1_4

ord2

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

374KB

Virtual Size

374KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_82c451539f8190b650b72910de477f9f_glassworm_icedid_luca-stealer_njrat_stealc

d3d11

d3dcompiler_47

setupapi

hid

user32

advapi32

iphlpapi

ws2_32

tbs

wintrust

crypt32

wevtapi

kernel32

gdi32

shell32

ole32

oleaut32

gdiplus

imm32

xinput1_4

generic