2026-05-06_c2cb0c60e990fb0cbbd83998a85f3000_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-06_c2cb0c60e990fb0cbbd83998a85f3000_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc
Size 6.7MB
Sample260506-rwxfdacz21
SHA256 4b47a183bff2c1df415a6c80801760fb2599c4c7f31f28fad9d4bc1934bcbdad
MD5 c2cb0c60e990fb0cbbd83998a85f3000
SHA1 364105f7f375a703c3f9169b174e564b90f77c3f
SHA512 427df16f14ab9e245b13151d1358677f57cec6c6e0ce2bc77b6e583f18a64404a76cc1b75ee31e79245a0db5a0051a39c5d6782031fd590e33eea560ff5f2492
SSDEEP 98304:ouV2CnXGWTRBI93z63Fx/hi8EzmBmhzA2ZpXGPIy6:oyWWTRBI93z63FxEFmBmhzA2ZpXG
TLSH
T117667BC7AD675AE8E292D638B8B63317F56733690B24C6FF11D01DA16B063C0166B34E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-06_c2cb0c60e990fb0cbbd83998a85f3000_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-05-06_c2cb0c60e990fb0cbbd83998a85f3000_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

.exe 6.7MB

2026-05-06_c2cb0c60e990fb0cbbd83998a85f3000_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 17df72885d83477c1710fb6f81581552
SHA256 4b47a183bff2c1df415a6c80801760fb2599c4c7f31f28fad9d4bc1934bcbdad
MD5 c2cb0c60e990fb0cbbd83998a85f3000
SHA1 364105f7f375a703c3f9169b174e564b90f77c3f
SHA512 427df16f14ab9e245b13151d1358677f57cec6c6e0ce2bc77b6e583f18a64404a76cc1b75ee31e79245a0db5a0051a39c5d6782031fd590e33eea560ff5f2492
SSDEEP 98304:ouV2CnXGWTRBI93z63Fx/hi8EzmBmhzA2ZpXGPIy6:oyWWTRBI93z63FxEFmBmhzA2ZpXG
TLSH
T117667BC7AD675AE8E292D638B8B63317F56733690B24C6FF11D01DA16B063C0166B34E
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3894432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

ws2_32

WSACreateEvent WSACloseEvent WSAResetEvent send getsockopt WSAIoctl WSAEnumNetworkEvents gethostname WSAWaitForMultipleEvents ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl select __WSAFDIsSet closesocket WSASetLastError setsockopt recv getsockname getpeername connect bind accept WSACleanup WSAStartup ntohs socket htons WSAGetLastError WSAEventSelect

iphlpapi

if_nametoindex

crypt32

CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW CryptDecodeObjectEx CertFreeCRLContext PFXImportCertStore CertEnumCertificatesInStore CertAddCertificateContextToStore CertFreeCTLContext CertFindExtension CertCloseStore CertGetNameStringW CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertOpenStore

secur32

InitSecurityInterfaceW

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable

kernel32

HeapFree FlsGetValue FlsSetValue FlsFree HeapAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale VirtualProtect GetUserDefaultLCID ExitProcess WriteConsoleW SetFilePointerEx GetConsoleOutputCP ReadConsoleW GetConsoleMode FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetCurrentProcess TerminateProcess GetModuleFileNameW GetModuleHandleA Sleep LoadLibraryA CloseHandle GetProcAddress CreateProcessW GetModuleHandleW VirtualFree WriteFile OutputDebugStringA VirtualAlloc GetTempPathW CreateFileW GetLastError DeleteFileW LocalFree MoveFileExW GetCurrentProcessId RemoveVectoredExceptionHandler GetLocaleInfoA MultiByteToWideChar QueryPerformanceFrequency GetSystemInfo IsDBCSLeadByte EnumSystemLocalesW FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx GetTickCount SetLastError GetFullPathNameW WaitForSingleObjectEx CreateThread GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW FormatMessageW GetFileSizeEx GetTickCount64 RtlUnwindEx InitializeCriticalSectionAndSpinCount InitializeSListHead GetStartupInfoW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer GetSystemTimeAsFileTime WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RaiseException SleepConditionVariableSRW GetDriveTypeW HeapReAlloc GetTimeZoneInformation FlushFileBuffers SetStdHandle SetEndOfFile FlsAlloc GetCurrentDirectoryW OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetCurrentThreadId FreeLibraryAndExitThread ExitThread GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize VerSetConditionMask RtlUnwind LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc TryAcquireSRWLockExclusive

user32

GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos CloseClipboard wsprintfW GetWindowRect SetWindowPos GetCursorPos DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW SetLayeredWindowAttributes TranslateMessage PostQuitMessage OpenClipboard EmptyClipboard wsprintfA UpdateWindow

advapi32

GetTokenInformation ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash OpenProcessToken

shell32

ShellExecuteA ShellExecuteW

ntdll

RtlPcToFileHeader

d3dcompiler_47

D3DCompile

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

bcrypt

BCryptGenRandom

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

745KB

Virtual Size

744KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-06_c2cb0c60e990fb0cbbd83998a85f3000_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

d3d11

dwmapi

ws2_32

iphlpapi

crypt32

secur32

winhttp

kernel32

user32

advapi32

shell32

ntdll

d3dcompiler_47

imm32

bcrypt

generic