2026-11-12_4ccc1640ca8eba6765994885a6e5c61c_glassworm_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_4ccc1640ca8eba6765994885a6e5c61c_glassworm_icedid_luca-stealer_njrat
Size 9.3MB
Sample261113-d3f53sfs8s
SHA256 df52e5b172019af16a2fb859394a15910f7a32349fb0ada467f0790bdf69fb7a
MD5 4ccc1640ca8eba6765994885a6e5c61c
SHA1 e682ea71872df9780e4799f592b1d07624d33622
SHA512 6a2bce65b3ae80b8e6c9f9b7748c54e3cad46c8febe9cd2a14230675bad8ace42c346e6efbc4fa782c7617a188d1b7956334528bebbe14151f69a2e3590d827c
SSDEEP 49152:pVUz0Wypc3mnKA995Gwp4Z6uqjpuNKeA4EmsrwuEZkYbpkCX1wwuL1ui2pCr9gAF:/wwFReuavI1Z
TLSH
T1CCA6B602A7354DC5C851C23DCB62B261EA713C4EEB7163B2DA953A1DAF753609FB8384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_4ccc1640ca8eba6765994885a6e5c61c_glassworm_icedid_luca-stealer_njrat

File Explorer

2026-11-12_4ccc1640ca8eba6765994885a6e5c61c_glassworm_icedid_luca-stealer_njrat

.exe 9.3MB

2026-11-12_4ccc1640ca8eba6765994885a6e5c61c_glassworm_icedid_luca-stealer_njrat

IMPHASH 7e9d5312e031058de341a4c5e211e51e
SHA256 df52e5b172019af16a2fb859394a15910f7a32349fb0ada467f0790bdf69fb7a
MD5 4ccc1640ca8eba6765994885a6e5c61c
SHA1 e682ea71872df9780e4799f592b1d07624d33622
SHA512 6a2bce65b3ae80b8e6c9f9b7748c54e3cad46c8febe9cd2a14230675bad8ace42c346e6efbc4fa782c7617a188d1b7956334528bebbe14151f69a2e3590d827c
SSDEEP 49152:pVUz0Wypc3mnKA995Gwp4Z6uqjpuNKeA4EmsrwuEZkYbpkCX1wwuL1ui2pCr9gAF:/wwFReuavI1Z
TLSH
T1CCA6B602A7354DC5C851C23DCB62B261EA713C4EEB7163B2DA953A1DAF753609FB8384
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4222288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

torture.pdb

user32

GetClientRect MessageBoxW

shell32

SHGetFolderPathW

advapi32

LookupPrivilegeValueA OpenProcessToken RegOpenKeyExW RegEnumValueA AdjustTokenPrivileges

shlwapi

PathAppendW wnsprintfW PathFindFileNameW PathRemoveFileSpecW

ws2_32

WSAGetLastError WSAStartup socket send ntohs WSAIoctl WSARecv closesocket connect htons

gdi32

GetObjectA SetDCPenColor SetDCBrushColor SelectObject GetStockObject GetCurrentObject Rectangle

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpSetStatusCallback WinHttpOpen WinHttpCloseHandle

dwrite

DWriteCreateFactory

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

clang_rt.asan_dynamic-x86_64

__asan_wrap_wcsnlen __asan_wrap_wcslen __asan_wrap_strtoll_static __asan_wrap_strtol_static __asan_wrap_strtok __asan_wrap_strspn __asan_wrap_strpbrk __asan_wrap_strnlen __asan_wrap_wcsncpy __asan_wrap_strncpy __asan_wrap_strncmp __asan_wrap_wcsncat __asan_wrap_strncat __asan_wrap_strlen __asan_wrap__strdup __asan_wrap_strcspn __asan_wrap_wcscpy __asan_wrap_strcpy __asan_wrap_strcmp __asan_wrap_wcscat __asan_wrap_strcat __asan_wrap_frexp __asan_wrap_atoll_static __asan_wrap_atoi_static __asan_wrap_atol_static __sanitizer_cov_pcs_cleanup__dll __sanitizer_cov_pcs_init__dll __sanitizer_cov_bool_flag_init__dll __sanitizer_cov_8bit_counters_cleanup__dll __sanitizer_cov_8bit_counters_init__dll __sanitizer_cov_trace_switch__dll __sanitizer_cov_store16__dll __sanitizer_cov_store8__dll __sanitizer_cov_store4__dll __sanitizer_cov_store2__dll __sanitizer_cov_store1__dll __sanitizer_cov_load16__dll __sanitizer_cov_load8__dll __sanitizer_cov_load4__dll __sanitizer_cov_load2__dll __sanitizer_cov_load1__dll __sanitizer_cov_trace_pc_indir__dll __sanitizer_cov_trace_pc_guard_cleanup__dll __sanitizer_cov_trace_pc_guard_init__dll __sanitizer_cov_trace_pc_guard__dll __sanitizer_cov_trace_gep__dll __sanitizer_cov_trace_div8__dll __sanitizer_cov_trace_div4__dll __sanitizer_cov_trace_const_cmp8__dll __sanitizer_cov_trace_const_cmp4__dll __sanitizer_cov_trace_const_cmp2__dll __asan_default_suppressions__dll __sanitizer_cov_trace_cmp8__dll __asan_aligned_realloc __sanitizer_cov_trace_cmp2__dll __sanitizer_cov_trace_cmp1__dll __sanitizer_cov_trace_cmp__dll __sancov_default_options__dll __sanitizer_ignore_free_hook__dll __sanitizer_malloc_hook__dll __sanitizer_free_hook__dll __sanitizer_weak_hook_strstr__dll __sanitizer_weak_hook_strncmp__dll __sanitizer_weak_hook_strcmp__dll __sanitizer_weak_hook_memcmp__dll __sanitizer_get_dtls_size__dll __sanitizer_sandbox_on_notify__dll __sanitizer_report_error_summary__dll __sanitizer_on_print__dll __sanitizer_register_weak_function __sanitizer_override_function __asan_storeN __asan_get_report_description __asan_set_error_report_callback __asan_delete_size __asan_delete __asan_store8 __asan_store4 __asan_store2 __asan_store16 __asan_store1 __asan_set_shadow_f8 __asan_set_shadow_00 __asan_report_store8 __asan_report_store4 __asan_report_store2 __asan_report_store16 __asan_report_store1 __asan_report_load8 __asan_report_load4 __asan_report_load2 __asan_report_load16 __asan_report_load1 __asan_memset __asan_memcpy __asan_loadN __asan_load8 __asan_load4 __asan_load2 __asan_load16 __asan_load1 __asan_unpoison_memory_region __asan_poison_memory_region __asan_on_error__dll __asan_should_detect_stack_use_after_return __asan_get_shadow_memory_dynamic_address __asan_set_seh_filter __sanitizer_get_ownership __asan_msize __asan_aligned_msize __asan_free __asan_malloc __asan_calloc __asan_realloc __asan_recalloc __asan_aligned_malloc __asan_default_options__dll __asan_aligned_offset_malloc __asan_aligned_free __asan_aligned_offset_realloc __asan_aligned_offset_recalloc __asan_aligned_recalloc __asan_register_globals __asan_unregister_globals __sanitizer_cov_trace_const_cmp1__dll __sanitizer_cov_trace_cmp4__dll

kernel32

GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP SetStdHandle LoadLibraryA GetProcAddress RaiseException FreeLibrary GetCurrentThread GetCurrentThreadId GetFileSizeEx GetEnvironmentStringsW OutputDebugStringW SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers LCMapStringW OutputDebugStringA GetStringTypeW CompareStringW IsValidCodePage SetEndOfFile VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA WriteConsoleW GetFileType GetStdHandle GetModuleHandleExW RtlPcToFileHeader TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer DeleteCriticalSection SetLastError RtlUnwind RtlUnwindEx SearchPathW PssQuerySnapshot PssFreeSnapshot PssCaptureSnapshot MultiByteToWideChar LoadLibraryExW OpenProcess GetTempPathW GetTempFileNameW GetEnvironmentVariableW InitializeSListHead GetSystemTimeAsFileTime GetModuleHandleW GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateJobObjectA FileTimeToSystemTime GetComputerNameA CopyFileW SetDllDirectoryA CreateFileMappingA GetModuleFileNameW SetInformationJobObject AssignProcessToJobObject GetLargePageMinimum UnmapViewOfFile MapViewOfFile OpenFileMappingW CreateFileMappingW VirtualFree VirtualAlloc GetWindowsDirectoryA GetSystemInfo GlobalMemoryStatusEx GetCurrentThreadStackLimits GetProcessId CreateProcessW ResumeThread CreateThread GetExitCodeProcess TerminateProcess ExitProcess GetCurrentProcessId GetCurrentProcess CreateSemaphoreW WaitForMultipleObjects Sleep OpenSemaphoreW CreateEventW WaitForSingleObject ReleaseSemaphore ResetEvent SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock CancelIoEx GetOverlappedResult GetQueuedCompletionStatus CreateIoCompletionPort QueryPerformanceFrequency QueryPerformanceCounter CreateNamedPipeW GetLastError SetUnhandledExceptionFilter CloseHandle IsDebuggerPresent WriteFile ReadFile GetLogicalDriveStringsW GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW CreateDirectoryW FindFirstFileW FindClose DeleteFileW CreateFileW GetCurrentDirectoryW

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.3MB

Virtual Size

7.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.raddbg

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdbgia

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.WEAK

Size

512B

Virtual Size

392B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.INTR

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

201KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_4ccc1640ca8eba6765994885a6e5c61c_glassworm_icedid_luca-stealer_njrat

user32

shell32

advapi32

shlwapi

ws2_32

gdi32

winhttp

dwrite

d3d11

d3dcompiler_47

clang_rt.asan_dynamic-x86_64

kernel32

generic