2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat
Size 14.6MB
Sample261107-n7dkvsxv4k
SHA256 9b15c18122897673552600d6face60f332d3d18a9e3f89f75ad7da8102fb48dc
MD5 9243b7bc8e87a20ef4531898da19c4db
SHA1 f6fad9bdab5d48052c7206c8f24be4b793915add
SHA512 407b67b579c5281b26fcf2d3c3b1bac29adf6156956042e56f8f5c03a9a618f79434df39ae45eae696e78ec245943d494a877a65cb8b70deb75eed6683f38e8e
SSDEEP 98304:0Sot89pGwV9sxy3D8+3z6ZcKNXbarFTgcpURze1:XotipGw7ZT8+3z6Z9barFTHUJe1
TLSH
T16FF69D315F9A21DECCA6C8B8CF19164BDD30B40B633166BB4DD6DE621C77B4096ACB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat

File Explorer

2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat

.exe 14.6MB

2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat

IMPHASH 6382669effda0f1ba5c8b67a0cf43115
SHA256 9b15c18122897673552600d6face60f332d3d18a9e3f89f75ad7da8102fb48dc
MD5 9243b7bc8e87a20ef4531898da19c4db
SHA1 f6fad9bdab5d48052c7206c8f24be4b793915add
SHA512 407b67b579c5281b26fcf2d3c3b1bac29adf6156956042e56f8f5c03a9a618f79434df39ae45eae696e78ec245943d494a877a65cb8b70deb75eed6683f38e8e
SSDEEP 98304:0Sot89pGwV9sxy3D8+3z6ZcKNXbarFTgcpURze1:XotipGw7ZT8+3z6Z9barFTHUJe1
TLSH
T16FF69D315F9A21DECCA6C8B8CF19164BDD30B40B633166BB4DD6DE621C77B4096ACB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

19:5d:d5:bf:a2:98:90:2f:9e:50:60:6a:1a:bf:bf:48:31:50:89:ac:6a:39:8a:12:e5:f4:92:e4:44:ac:4b:70

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=CS Cheat Check (self-signed),O=CS Cheat Check

Chains

Nov 6, 2026

CN=CS Cheat Check (self-signed),O=CS Cheat Check

Minor OS version

Major OS version

Entry point

8363328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

CsCheatCheck.pdb

setupapi

SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW SetupDiGetDevicePropertyW CM_Get_DevNode_Status SetupDiEnumDeviceInterfaces SetupDiOpenDevRegKey SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsA SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyA SetupDiDestroyDeviceInfoList

shlwapi

ord12

advapi32

RegGetValueW EventWriteTransfer EventSetInformation EventRegister EventUnregister GetUserNameA ConvertStringSecurityDescriptorToSecurityDescriptorW GetUserNameW RegEnumKeyExA AdjustTokenPrivileges RegEnumKeyW RegQueryInfoKeyW QueryServiceStatus CloseServiceHandle RegQueryValueExW RegOpenKeyExW RegCloseKey GetTokenInformation OpenServiceA RegEnumValueW LookupAccountSidW RegEnumValueA ConvertSidToStringSidW RegOpenKeyExA RegLoadKeyW RegUnLoadKeyW OpenEventLogW OpenProcessToken StartServiceA RegEnumKeyExW ControlService ConvertStringSidToSidW ReadEventLogW CloseEventLog OpenSCManagerA LookupPrivilegeValueA RegQueryValueExA

user32

PostMessageW MapVirtualKeyW ScreenToClient GetCursorPos GetIconInfo wsprintfA EnumDisplayMonitors QueryDisplayConfig GetDisplayConfigBufferSizes DestroyIcon DrawIconEx DisplayConfigGetDeviceInfo FillRect IsWindow GetForegroundWindow SetLayeredWindowAttributes BringWindowToTop ReleaseDC wsprintfW DefWindowProcW GetMessageA LoadImageA DispatchMessageA LoadCursorA RegisterClassExW DefWindowProcA LoadIconA GetClientRect KillTimer PostQuitMessage GetWindowThreadProcessId IsWindowVisible MonitorFromWindow PostMessageA GetRawInputDeviceInfoW ClientToScreen GetWindowTextA GetMonitorInfoA EnumWindows FindWindowA GetRawInputDeviceList DestroyWindow CreateWindowExW SendMessageW GetSystemMetrics DispatchMessageW PeekMessageW TranslateMessage SystemParametersInfoW UpdateWindow GetWindowRect SetWindowPos MessageBoxW SetWindowRgn ShowWindow MessageBoxA FindWindowW SendMessageA GetWindowLongPtrA SetWindowLongPtrA ReleaseCapture SetForegroundWindow IsIconic GetDC

gdi32

GetDIBits GetObjectA CreateDIBSection CreateCompatibleDC DeleteDC SelectObject CreateFontW GetStockObject TextOutW GetTextExtentPoint32W SetTextColor SetBkMode CreatePen Rectangle CreateSolidBrush DeleteObject CreateFontIndirectW CreateRoundRectRgn

kernel32

FlsGetValue FlsAlloc GetStdHandle FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlPcToFileHeader RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind FlsSetValue RtlCaptureContext GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetNativeSystemInfo GetExitCodeThread AcquireSRWLockShared ReleaseSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockExclusive FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP GetACP GetEnvironmentStringsW GetCommandLineW GetCommandLineA RtlLookupFunctionEntry GetOEMCP SetDefaultDllDirectories GetCurrentProcess GetUserDefaultUILanguage CreateMutexW Sleep GetLastError CloseHandle QueryPerformanceCounter MulDiv SetUnhandledExceptionFilter CreateDirectoryW SizeofResource FindFirstFileW FindNextFileW WriteFile ExpandEnvironmentStringsW RemoveDirectoryW GetModuleFileNameW GetEnvironmentVariableW GetTempPathW IsValidCodePage WaitForSingleObject FreeEnvironmentStringsW GetFileAttributesW GetFileAttributesExW LockResource DeleteFileW LoadLibraryW LoadResource FindResourceW GetLocalTime GetProcAddress GetCurrentProcessId CreateProcessW WideCharToMultiByte GetTickCount GetExitCodeProcess OutputDebugStringA GetTickCount64 GetFileAttributesA FreeLibrary GetCurrentThreadId MultiByteToWideChar GetTempPathA ReadFile GetVolumeInformationW GetLogicalDrives FindFirstFileA FindNextFileA FileTimeToSystemTime GetWindowsDirectoryA GetFileSize GlobalMemoryStatusEx GetDriveTypeW SystemTimeToTzSpecificLocalTime QueryDosDeviceW CompareFileTime MoveFileA GetFileSizeEx HeapFree GetLongPathNameW DeviceIoControl TerminateProcess ExpandEnvironmentStringsA GetSystemDirectoryW GetCurrentDirectoryA GetLogicalDriveStringsW CopyFileA MoveFileExA CreateFileA GetSystemDirectoryA LoadLibraryA DeleteFileA HeapAlloc GetWindowsDirectoryW SetFilePointerEx LocalFree RemoveDirectoryA FindFirstStreamW GetProcessHeap SystemTimeToFileTime CopyFileW CreateProcessA GetSystemTimeAsFileTime CreateDirectoryA FindNextStreamW CompareStringOrdinal RtlUnwind GetCurrentThread SetThreadPriority SetThreadPriorityBoost WaitForThreadpoolTimerCallbacks lstrcatA CancelWaitableTimer CloseThreadpoolTimer lstrcpyA SetThreadpoolTimer CreateThreadpoolTimer GetDriveTypeA GetVolumeInformationA GetDiskFreeSpaceExA SetProcessMitigationPolicy GetFileAttributesExA GetFileInformationByHandleEx MoveFileExW FlushFileBuffers Thread32Next Thread32First SuspendThread ResumeThread CreateToolhelp32Snapshot GetThreadContext PurgeComm GetCommState SetCommTimeouts SetCommState GetComputerNameW QueryFullProcessImageNameW CreateEventW CancelIoEx GetOverlappedResult FindFirstFileExW GetSystemInfo GetProcessWorkingSetSize SetProcessWorkingSetSize QueryPerformanceFrequency ReleaseSRWLockExclusive GetTimeZoneInformation ReadConsoleW FindClose GetConsoleMode GetLocaleInfoEx SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitOnceBeginInitialize InitOnceComplete MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime DeleteCriticalSection LockFileEx UnlockFile HeapDestroy HeapCompact RaiseException HeapReAlloc WaitForSingleObjectEx FlushViewOfFile GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate UnmapViewOfFile UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer InitializeCriticalSection SetEnvironmentVariableW SetStdHandle WriteConsoleW CreateFileW GetEnvironmentVariableA OutputDebugStringW GetModuleHandleW LoadLibraryExW AreFileApisANSI TryEnterCriticalSection HeapCreate EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW LockFile LeaveCriticalSection

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

comctl32

InitCommonControlsEx

crypt32

CertGetCertificateContextProperty

ole32

CoInitializeSecurity CoTaskMemAlloc StgOpenStorage CoSetProxyBlanket CoTaskMemFree CoUninitialize CoCreateInstance CoInitializeEx

oleaut32

VariantTimeToSystemTime SysFreeString SysAllocString VariantClear VariantInit

shell32

ord680 SHOpenFolderAndSelectItems ShellExecuteA SHGetFolderPathA SHParseDisplayName SHFileOperationW SHGetKnownFolderPath SHGetNameFromIDList SHGetFolderPathW ord18 SHGetPathFromIDListW ord25 SHGetFileInfoW ExtractIconExW ShellExecuteW

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

Name

.text

Size

8.7MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

237KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_9243b7bc8e87a20ef4531898da19c4db_glassworm_icedid_luca-stealer_njrat

PE Signature issue

setupapi

shlwapi

advapi32

user32

gdi32

kernel32

dwmapi

comctl32

crypt32

ole32

oleaut32

shell32

version

generic