2026-11-03_7e6ad57410dd55fd297675a57efc7e81_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_7e6ad57410dd55fd297675a57efc7e81_glassworm_icedid_luca-stealer_njrat_stealc
Size 21.7MB
Sample261104-taaqlabs7v
SHA256 c8c5a9b8a11dc0354698765ccf79780d2cbfe5cb1b6144c60c942a800d09a704
MD5 7e6ad57410dd55fd297675a57efc7e81
SHA1 b3e6940ab36f18ba9721d0f4dff6dcd79c703f49
SHA512 d44e0c51f65b2f0a2a4ffa676ec7677873e48c0710c09426dda02b87a384c2c03d68572314920dcd321b8b21a845e44ef57ba1f6405794dff2e225dae524a22c
SSDEEP 393216:WqAWNZ+HH08SP5+KIxijLfRrJiFpg7wV4o5X36fF9c96zPRKYrrVx8b2D5VCfV/w:vAWg4RV2hXuJzPRBJx8bkX
TLSH
T101370276A39812ACC027C438C627DE06F3B1341947B456EF76D46E952F77AE09E3AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vmprotect

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_7e6ad57410dd55fd297675a57efc7e81_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-11-03_7e6ad57410dd55fd297675a57efc7e81_glassworm_icedid_luca-stealer_njrat_stealc

.exe 21.7MB

2026-11-03_7e6ad57410dd55fd297675a57efc7e81_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 8af2de0a47775d5e3bf7cd7de3533ba3
SHA256 c8c5a9b8a11dc0354698765ccf79780d2cbfe5cb1b6144c60c942a800d09a704
MD5 7e6ad57410dd55fd297675a57efc7e81
SHA1 b3e6940ab36f18ba9721d0f4dff6dcd79c703f49
SHA512 d44e0c51f65b2f0a2a4ffa676ec7677873e48c0710c09426dda02b87a384c2c03d68572314920dcd321b8b21a845e44ef57ba1f6405794dff2e225dae524a22c
SSDEEP 393216:WqAWNZ+HH08SP5+KIxijLfRrJiFpg7wV4o5X36fF9c96zPRKYrrVx8b2D5VCfV/w:vAWg4RV2hXuJzPRBJx8bkX
TLSH
T101370276A39812ACC027C438C627DE06F3B1341947B456EF76D46E952F77AE09E3AB01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12734529

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

ole32

CoSetProxyBlanket

dxgi

CreateDXGIFactory1

dwmapi

DwmGetWindowAttribute

dcomp

DCompositionCreateDevice

winmm

timeEndPeriod

ntdll

RtlVirtualUnwind

comdlg32

GetOpenFileNameW

advapi32

CryptGetHashParam

shell32

ShellExecuteW

crypt32

CertFreeCertificateChain

bcrypt

BCryptHashData

secur32

InitSecurityInterfaceA

ws2_32

select

iphlpapi

if_nametoindex

kernel32

TlsSetValue FlsSetValue LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

SetWindowPos GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

BitBlt

oleaut32

SysAllocString

shlwapi

SHDeleteKeyW

imm32

ImmSetCompositionWindow

wtsapi32

WTSSendMessageW

�a+�D.O��E��)�(jvc�F�[�j֦�h�(��c�уؗ��,N+��W�ioˢ�5�xu��`��%ATtLѠ?{" R��6~⽎[�yu�}�1�n��x�:RH2<~>�?�R��ŏ��D�_�@�懋krh)j��nԉ=ɥi�_7z�}��d{}�`��k'��#&ʪ�e��i��Xo��lb�as$�u�� mr޲;?�d�,rl�L>� N�Qn�^�AN�ZÉБ0{��Vq۶5��b�*=�Rq��Gb��Y��i�޿MI �~O�}�s��!+��4=9J[6��C��&1<��V3A��6�əo�-l��t�A�]��?��]��Uၝ2��nn��\xU�&��n병:t��h*�� 9%��)h>��Ct�)��g��}�W_�1��>��E��t$į��v��e�EM!�<ܖ�'�_`�C�C#I_)��!B~&#��*��a�Z6��R��ݳm�V��f�;]}|ĳ2�m�w��rh�m�^��^��6��\�t-ؘ �:,�!�EO�V�&ݭ�oF��+49�NPHH��4�C3W� �R53��m(� G�)��'��o[H��sz0Q/��ڌ[!lMǧhH� �j�&��đ��[gΈ�Н �3� DB��+�|�Wү|4��208rz�'�粅ġ- �-+��ݨ��{��h��¾c�s2f��%�_>��b�@0��R��G/��7�Q��@z!��Tf%F�<o�ʭT��B��2�,�\i7��=藅^�A`3q=�*B�*�/>r8�.�}պ��̓Opȱ��W�lO�=��7�zW�x"��T C��龞.\75��x]+�(�/hl1��l8�r�U�D��<i��<'Ƴ� �U��8��d��+~�'�K(Sb��yo#'Ԡ�M��U w�7�28�, �F?.�Bic�t-��,E��\Z"��(<QᲖ�}��jW~��#S\@��0��l3vJ�Ya8a6n�X(�U��F=`��g�VD�P�?�p��g�s�F wK��%|�F#� �Keij�[O 1"��{[��&CЌ��W�y�~!E/G�f�x�e��ɓj!�� Y�b��nmX��C-s��:_��iN�i��J��g��w�ɜ��S�͛�<&��:��φ�ao%/��=��~/�Q�84q��%x��6��a&��^��I��pK�X)Y�L��WF*~|L�:t." �*�Ŗ��t��,�)��{V�E��9��/�h�ui��\Cүw̠]!��]�L��W�Ì*��4 ��c�Z_��I5 �0M��5l|(_&u��f�ZT��'su��񆦽�K�n�K��_��խt�y�@B1?��؜$S{�e��~��4~�I��(/ Ù�X��p�\ߨ6��1��B��8�X��ќ �ׁ�q�_��͛}�U��،�[G~�j��2̉�L��8��&�;�" e�<��+�*��)S[.��U�M�A�d�p��M�Ke��Y��$UJF�jH,U51|��'�3c|sWh�ן�lV��M�=A ��h z��c�5Lh��9�PV�Ox��4��$TS�F��XY蟸�T��΍>��I|�R��׼b�F0�X��1љM��nH�D0�|�߮�A��=�S]�P�� "��Z/�%e�n-�{�!�N�؃�Fϣx��n:�*sO�՜_L%D�Y�Ⱦ��$�{pC?%z��C�9m��@C�l:��gm�%vm3��W��{U�VҞ�~��^\�M,��'�f-O��"�V��WJ��1��@�s�ñ�3]w耨ݬ�hy�7��؝�o��X.��W�P��ރ��n��57�/�Kh��<��9�}��J��_��f��7\�s�&4i�qu�{#g6Vb�eF�J�(u�P=�`�@A�M��͍�u�^L$��z��3��>��BR��h��r_��u�W��Y��ő�0K��=lx�7��Q��,POKv5*38q%��]��5՞��]=��Ԝ2!�2Yu��] uo�I�q�N��u3��-:��q?�׾��6o��ܐ��d��6M��mZ��2��-�q��<�a4�4��~xj@��_�HN��( R��,bkɮ��pŽTKT��9�ܽ̀��+J�Nӏ�yE�B��f@�M|��?v�*�KSB�Wa zy��_ |�o�A��~�pq��W�?�$E��>d]�Aɝa�=K13&Ѭ��&��Df�VIT>��4�S�5�1.��M]G��Q*��Q��\3��Z��$��vv�_تLJXE�@xU��׵� �� 2CLx��imu��q!�]��ą(>J*��(o�3��~��e��)l|ɠ6Zn�$?d��g�g�ϵ��7(��bK��g�G�� zCM��/RN�E��k��=�#��0�ۥ��kK��(u:�R9j��pN�EJQEɞ�W��U��"U��i��f�e,ZA�:#�_M[[�}��L��Q�?ƬP�ae��P�� :��J;�3�b��'�[�pN��f`��|I2h�N��o�S9P ��F�K�]�$��b?�|Q�ЍQ&��gԺ�D��"��։��b�av��>i6d�7&V#��@(W��]�Ќ��|R<��f�T.�Ft��f��.��JM�.��R��ȩ5�P��{?�K�(.�c�[�y||D!�aXp��=J�\��%�;XA�ɪ 9Eq�l��^��#x ??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B DH_Cs2_Update_Channel

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.dh_mate

Size

1024B

Virtual Size

795B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.dh_rend

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.5MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

166KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8.4MB

Virtual Size

8.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_7e6ad57410dd55fd297675a57efc7e81_glassworm_icedid_luca-stealer_njrat_stealc

d3d11

d3dcompiler_47

ole32

dxgi

dwmapi

dcomp

winmm

ntdll

comdlg32

advapi32

shell32

crypt32

bcrypt

secur32

ws2_32

iphlpapi

kernel32

user32

gdi32

oleaut32

shlwapi

imm32

wtsapi32

generic