308ea3bfa161799aa4a84dea195ea9cfff8071cc216c99eb472cc764be3b7cf4

Analysis

max time kernel
149s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 02:52

Target
2026-05-23_a658c3ac9bd1ebf42bd4e787271af9e0_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
Size 5.2MB
Sample260523-dc1rssbx9l
SHA256 308ea3bfa161799aa4a84dea195ea9cfff8071cc216c99eb472cc764be3b7cf4
MD5 a658c3ac9bd1ebf42bd4e787271af9e0
SHA1 441a546ca4242622718b29471703b0e6dcfa2826
SHA512 e547cc7b10090e4091231809c8821f33c8560b1b0ec569c3f20f55f08cf8fe1233130b918e4357401f7f5721c5a83ade8c702649716d54b8eef1768d692b9ea8
SSDEEP 98304:3vc9Ecw3AfH3gpQ7QqQSxULK+NbrrRCu47ZOGJqyqN6+b:kmcw3AfgpQ7QqQSxULK+N3RCuqJqyqNB
TLSH
T1A8468D3EC91170ADF6C2D134E10447779871B3321B22BEBB41B687952269EF44FB936A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2960	2026-05-23_a658c3ac9bd1ebf42bd4e787271af9e0_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-23_a658c3ac9bd1ebf42bd4e787271af9e0_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_a658c3ac9bd1ebf42bd4e787271af9e0_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2960