2026-11-13_eefb6fa2509d9c8502a2372dbd8fc67b_glassworm_icedid_luca-stealer_njrat_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-13_eefb6fa2509d9c8502a2372dbd8fc67b_glassworm_icedid_luca-stealer_njrat_quasar-rat
Size 23.7MB
Sample261113-yx1mraf16w
SHA256 d8665ae70980bbf5426152099117f1b9441f7994ea0bc931904d5bb3717e8301
MD5 eefb6fa2509d9c8502a2372dbd8fc67b
SHA1 091602e2e22bf1b051d93767675f92947b7ef6c6
SHA512 01b296afe10f8d0d81f840fa0e16a8590d60c2936f8ec8e10c714ce52f6a6b22d994b2852217e2180764e731ef1ab3782bcebd063bd4dbd583b5851aa06e9cd4
SSDEEP 196608:0gxhRoUNojkbJj2JaWsF5TWHgjsMCO0qdt0v1T0jIVVW5p:HxPoubVF5TWHgjsMCudt0v1TLVQp
TLSH
T1504718213A9A99ADD59AC870834646B35E2130DB1B36BAFF44C496393F7DAF41B3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-13_eefb6fa2509d9c8502a2372dbd8fc67b_glassworm_icedid_luca-stealer_njrat_quasar-rat

File Explorer

2026-11-13_eefb6fa2509d9c8502a2372dbd8fc67b_glassworm_icedid_luca-stealer_njrat_quasar-rat

.exe 23.7MB

2026-11-13_eefb6fa2509d9c8502a2372dbd8fc67b_glassworm_icedid_luca-stealer_njrat_quasar-rat

IMPHASH 431a12f38d56cbc96bd2d612de30709a
SHA256 d8665ae70980bbf5426152099117f1b9441f7994ea0bc931904d5bb3717e8301
MD5 eefb6fa2509d9c8502a2372dbd8fc67b
SHA1 091602e2e22bf1b051d93767675f92947b7ef6c6
SHA512 01b296afe10f8d0d81f840fa0e16a8590d60c2936f8ec8e10c714ce52f6a6b22d994b2852217e2180764e731ef1ab3782bcebd063bd4dbd583b5851aa06e9cd4
SSDEEP 196608:0gxhRoUNojkbJj2JaWsF5TWHgjsMCO0qdt0v1T0jIVVW5p:HxPoubVF5TWHgjsMCudt0v1TLVQp
TLSH
T1504718213A9A99ADD59AC870834646B35E2130DB1B36BAFF44C496393F7DAF41B3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16818812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

vibe_rs.pdb

kernel32

GetModuleHandleA Sleep HeapReAlloc GetStdHandle GetConsoleMode SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo LoadLibraryExA FormatMessageW SwitchToThread GetCurrentThreadId SetThreadPriority WaitForMultipleObjectsEx SetEvent CreateEventA SetConsoleCursorPosition SetConsoleCursorInfo FillConsoleOutputCharacterA FillConsoleOutputAttribute OutputDebugStringW WaitForMultipleObjects SetConsoleActiveScreenBuffer GetNumberOfConsoleInputEvents ReadConsoleInputW CreateConsoleScreenBuffer CreateFileW IsValidCodePage GetLastError LCMapStringW CompareStringW FindClose GetFileInformationByHandle PostQueuedCompletionStatus ReadFile GetOverlappedResult WriteFile CreateIoCompletionPort CancelIoEx InitializeCriticalSectionEx GetCommandLineA InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatusEx DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx SetFileCompletionNotificationModes CreateThread CreateSemaphoreW CancelIo ReadDirectoryChangesW ReleaseSemaphore InitializeSListHead GetSystemInfo GetNativeSystemInfo GetACP GetOEMCP GetCPInfo HeapAlloc HeapFree SetNamedPipeHandleState GetSystemTimePreciseAsFileTime GetProcessHeap CreateToolhelp32Snapshot GetCurrentThread ReleaseMutex CloseHandle CreateMutexA GetCurrentProcessId LoadLibraryA WaitForSingleObjectEx SleepEx ReadFileEx WriteFileEx IsDebuggerPresent WaitForSingleObject SetLastError GetFullPathNameW SetUnhandledExceptionFilter DuplicateHandle CopyFileExW WideCharToMultiByte SetHandleInformation CreateEventW UnhandledExceptionFilter SetEndOfFile HeapSize SetFileTime SetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetProcessId TerminateProcess CreateDirectoryW SetFilePointerEx SetThreadStackGuarantee MoveFileExW FindFirstFileExW ExitProcess GetFinalPathNameByHandleW SetStdHandle DeleteFileW GetModuleFileNameW ReadConsoleW WriteConsoleW GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetFileAttributesW FlsFree FlsAlloc GetModuleHandleExW GetModuleHandleW IsThreadAFiber FlsSetValue GetFileType GetFileSizeEx GetTempPathW FlushFileBuffers FindNextFileW SetFileAttributesW SetConsoleCtrlHandler RegisterWaitForSingleObject UnregisterWaitEx VirtualProtect GetConsoleWindow SetConsoleTitleW CreateJobObjectW SetInformationJobObject AssignProcessToJobObject Thread32First Thread32Next OpenThread GetProcessIdOfThread ResumeThread GetProcAddress GetCurrentProcess lstrlenW RtlVirtualUnwind RtlLookupFunctionEntry InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue LoadLibraryW RtlCaptureContext FlsGetValue GetStringTypeW PeekConsoleInputA GetConsoleCP GetComputerNameExW LoadLibraryExW FreeLibrary TlsFree GetSystemTimeAsFileTime CompareStringOrdinal QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW AddVectoredExceptionHandler GetCurrentDirectoryW GetCommandLineW GetStartupInfoW GetEnvironmentVariableW SetEnvironmentVariableW SetCurrentDirectoryW MultiByteToWideChar QueryPerformanceFrequency IsProcessorFeaturePresent

advapi32

RegCloseKey RegQueryValueExW RegCreateKeyTransactedW CredEnumerateW CredDeleteW CredWriteW CredFree CredReadW RegOpenKeyTransactedW RegOpenKeyExW RegCreateKeyExW SystemFunction036

oleaut32

GetErrorInfo SysFreeString SysStringLen

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

GetSystemMetrics GetForegroundWindow GetWindowThreadProcessId GetKeyboardLayout ToUnicodeEx VkKeyScanExW

bcrypt

BCryptGenRandom

ws2_32

WSAIoctl WSAGetLastError getsockopt connect closesocket setsockopt bind ioctlsocket WSASocketW shutdown WSASend send getaddrinfo getsockname getpeername WSAStartup freeaddrinfo recv

ntdll

NtCancelIoFileEx NtCreateNamedPipeFile NtReadFile NtWriteFile NtOpenFile NtCreateFile RtlNtStatusToDosError NtDeviceIoControlFile

crypt32

CertCloseStore CertFreeCertificateChainEngine CertDuplicateCertificateContext CertVerifyTimeValidity CertVerifyCertificateChainPolicy CertGetCertificateChain CertCreateCertificateChainEngine CertOpenStore CertAddEncodedCertificateToStore CertSetCertificateContextProperty CertFreeCertificateChain CertGetEnhancedKeyUsage CertEnumCertificatesInStore CertFreeCertificateContext

ole32

CoTaskMemFree CoCreateInstance CoUninitialize CoInitializeEx

userenv

GetUserProfileDirectoryW

OnigDefaultCaseFoldFlag OnigDefaultSyntax OnigEncodingASCII OnigEncodingUTF8 OnigSyntaxOniguruma OnigSyntaxRuby aws_lc_0_45_0_jent_entropy_collector_alloc aws_lc_0_45_0_jent_entropy_collector_free aws_lc_0_45_0_jent_entropy_init aws_lc_0_45_0_jent_entropy_init_ex aws_lc_0_45_0_jent_entropy_switch_notime_impl aws_lc_0_45_0_jent_read_entropy aws_lc_0_45_0_jent_read_entropy_safe aws_lc_0_45_0_jent_set_fips_failure_callback aws_lc_0_45_0_jent_version onig_builtin_cmp onig_builtin_count onig_builtin_error onig_builtin_fail onig_builtin_max onig_builtin_mismatch onig_builtin_skip onig_builtin_total_count onig_callout_tag_is_exist_at_callout_num onig_copy_encoding onig_end onig_error_code_to_str onig_foreach_name onig_free onig_free_body onig_free_match_param onig_free_match_param_content onig_get_arg_by_callout_args onig_get_args_num_by_callout_args onig_get_callback_each_match onig_get_callout_data onig_get_callout_data_by_callout_args onig_get_callout_data_by_callout_args_self onig_get_callout_data_by_callout_args_self_dont_clear_old onig_get_callout_data_by_tag onig_get_callout_data_by_tag_dont_clear_old onig_get_callout_data_dont_clear_old onig_get_callout_in_by_callout_args onig_get_callout_name_by_name_id onig_get_callout_num_by_callout_args onig_get_callout_num_by_tag onig_get_callout_tag_end onig_get_callout_tag_start onig_get_capture_range_in_callout onig_get_capture_tree onig_get_case_fold_flag onig_get_contents_by_callout_args onig_get_contents_end_by_callout_args onig_get_current_by_callout_args onig_get_default_case_fold_flag onig_get_encoding onig_get_match_stack_limit_size onig_get_name_id_by_callout_args onig_get_options onig_get_parse_depth_limit onig_get_passed_args_num_by_callout_args onig_get_progress_callout onig_get_regex_by_callout_args onig_get_retraction_callout onig_get_retry_counter_by_callout_args onig_get_retry_limit_in_match onig_get_retry_limit_in_search onig_get_right_range_by_callout_args onig_get_start_by_callout_args onig_get_string_by_callout_args onig_get_string_end_by_callout_args onig_get_subexp_call_limit_in_search onig_get_subexp_call_max_nest_level onig_get_syntax onig_get_used_stack_size_in_callout onig_initialize onig_initialize_encoding onig_initialize_match_param onig_is_error_code_needs_param onig_match onig_match_with_param onig_name_to_backref_number onig_name_to_group_numbers onig_new onig_new_match_param onig_noname_group_capture_is_active onig_number_of_capture_histories onig_number_of_captures onig_number_of_names onig_reg_init onig_region_clear onig_region_copy onig_region_free onig_region_init onig_region_new onig_region_resize onig_region_set onig_regset_add onig_regset_free onig_regset_get_regex onig_regset_get_region onig_regset_new onig_regset_number_of_regex onig_regset_replace onig_regset_search onig_regset_search_with_param onig_scan onig_search onig_search_with_param onig_set_callback_each_match onig_set_callout_data onig_set_callout_data_by_callout_args onig_set_callout_data_by_callout_args_self onig_set_callout_data_by_tag onig_set_callout_of_name onig_set_callout_user_data_of_match_param onig_set_capture_num_limit onig_set_default_case_fold_flag onig_set_match_stack_limit_size onig_set_match_stack_limit_size_of_match_param onig_set_parse_depth_limit onig_set_progress_callout onig_set_progress_callout_of_match_param onig_set_retraction_callout onig_set_retraction_callout_of_match_param onig_set_retry_limit_in_match onig_set_retry_limit_in_match_of_match_param onig_set_retry_limit_in_search onig_set_retry_limit_in_search_of_match_param onig_set_subexp_call_limit_in_search onig_set_subexp_call_max_nest_level onig_set_verb_warn_func onig_set_warn_func onig_setup_builtin_monitors_by_ascii_encoded_name onig_unicode_define_user_property onigenc_get_default_encoding onigenc_get_left_adjust_char_head onigenc_get_prev_char_head onigenc_get_right_adjust_char_head onigenc_get_right_adjust_char_head_with_prev onigenc_init onigenc_is_valid_mbc_string onigenc_set_default_caseconv_table onigenc_set_default_encoding onigenc_step_back onigenc_str_bytelen_null onigenc_strdup onigenc_strlen onigenc_strlen_null

Name

.text

Size

16.4MB

Virtual Size

16.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

59KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

818KB

Virtual Size

817KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-13_eefb6fa2509d9c8502a2372dbd8fc67b_glassworm_icedid_luca-stealer_njrat_quasar-rat

kernel32

advapi32

oleaut32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

user32

bcrypt

ws2_32

ntdll

crypt32

ole32

userenv

generic