2026-07-03_981ead9280a05215ca52b6a51ee74905_blankgrabber_glassworm_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_981ead9280a05215ca52b6a51ee74905_blankgrabber_glassworm_icedid_njrat_stealc
Size 8.4MB
Sample260703-xpdbtabt2n
SHA256 b708487b59bea3f3dd947cca644e7f65849101523585e84b959caa5840244c37
MD5 981ead9280a05215ca52b6a51ee74905
SHA1 b6bd63bedf188a835c42b30ab72e058d44beef80
SHA512 881996419fb5fea731e6216d149785bf2428335cada76045bee7213b324b5c2f1f737e4da79081692a9faa99fdf75d260cb81ae2c0e7aed66062d4acc2f49a09
SSDEEP 196608:A0AsGig2/HWy/lw2CPLat1GRyz99EZSZt+p5Y5EUzoMw90MEPot57kVpnN:8sj/WytwrRmZzzW0NPot57kVpnN
TLSH
T1EF96F6EA11C392D8C14AD5758652AB2FB67F7267023176DB71BC45F29E1AB423223F0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_981ead9280a05215ca52b6a51ee74905_blankgrabber_glassworm_icedid_njrat_stealc

File Explorer

2026-07-03_981ead9280a05215ca52b6a51ee74905_blankgrabber_glassworm_icedid_njrat_stealc

.exe 8.4MB

2026-07-03_981ead9280a05215ca52b6a51ee74905_blankgrabber_glassworm_icedid_njrat_stealc

IMPHASH 9c1f637454e2d12cbdc00bf8d19f2850
SHA256 b708487b59bea3f3dd947cca644e7f65849101523585e84b959caa5840244c37
MD5 981ead9280a05215ca52b6a51ee74905
SHA1 b6bd63bedf188a835c42b30ab72e058d44beef80
SHA512 881996419fb5fea731e6216d149785bf2428335cada76045bee7213b324b5c2f1f737e4da79081692a9faa99fdf75d260cb81ae2c0e7aed66062d4acc2f49a09
SSDEEP 196608:A0AsGig2/HWy/lw2CPLat1GRyz99EZSZt+p5Y5EUzoMw90MEPot57kVpnN:8sj/WytwrRmZzzW0NPot57kVpnN
TLSH
T1EF96F6EA11C392D8C14AD5758652AB2FB67F7267023176DB71BC45F29E1AB423223F0C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8067792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoCreateInstance CoUninitialize CoInitialize

ws2_32

WSAGetLastError accept bind htons getpeername socket closesocket WSAWaitForMultipleEvents getsockname gethostname htonl sendto recvfrom listen ioctlsocket freeaddrinfo getaddrinfo select __WSAFDIsSet WSACleanup WSAStartup ntohs getsockopt WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSAIoctl WSASetLastError setsockopt send recv connect

crypt32

CryptQueryObject CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertFreeCRLContext CertGetNameStringW CertFindExtension CertFreeCTLContext CertAddCertificateContextToStore

iphlpapi

if_nametoindex

secur32

InitSecurityInterfaceW

kernel32

FileTimeToSystemTime GetConsoleMode ReadConsoleW SystemTimeToTzSpecificLocalTime SetFilePointerEx HeapAlloc HeapFree FlsAlloc GetConsoleOutputCP GetDriveTypeW RtlUnwindEx InitializeSListHead GetVolumeInformationA DecodePointer CloseHandle GetLastError InitializeCriticalSectionEx DeleteCriticalSection TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA VerifyVersionInfoW Sleep EnterCriticalSection LeaveCriticalSection InitializeCriticalSection Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetSystemTimeAsFileTime GetCurrentProcess ResumeThread CreateProcessW GetExitCodeProcess GetSystemInfo VirtualAllocEx VirtualFreeEx ReadFile CreateNamedPipeW TerminateThread CreateThread GetCurrentProcessId WriteProcessMemory GetNativeSystemInfo VirtualProtectEx GetThreadContext ReadProcessMemory CreateRemoteThread SetThreadContext IsWow64Process VirtualQueryEx GetModuleFileNameW GetFileAttributesW LocalFree GetModuleHandleW CreateActCtxW WriteFile GetTempPathW CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW FlsGetValue MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW LCMapStringW GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW WaitForSingleObject DuplicateHandle GetCurrentThread ResetEvent GetTickCount DeviceIoControl Thread32Next Thread32First GetCurrentThreadId GetExitCodeThread LoadLibraryW SuspendThread GetThreadTimes OpenThread ReleaseSRWLockExclusive AcquireSRWLockExclusive GetFullPathNameW MoveFileExW SleepEx GetEnvironmentVariableA SetLastError GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects WaitForSingleObjectEx GetFileSizeEx FormatMessageA GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext OutputDebugStringW IsDebuggerPresent GetCPInfo LCMapStringEx EncodePointer AreFileApisANSI GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindClose WakeAllConditionVariable RaiseException RtlPcToFileHeader GetLocaleInfoEx WriteConsoleW FlsSetValue FlsFree VirtualProtect GetStringTypeW FreeLibraryAndExitThread ExitThread GetModuleHandleExW GetDateFormatW GetTimeFormatW ReleaseActCtx CompareStringW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc SleepConditionVariableSRW InitializeCriticalSectionAndSpinCount GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers HeapReAlloc SetStdHandle SetEndOfFile GetTimeZoneInformation HeapSize IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap DeactivateActCtx RtlUnwind TryAcquireSRWLockExclusive

user32

PeekMessageA DispatchMessageA TranslateMessage EnumDisplayMonitors GetMonitorInfoA MonitorFromWindow LoadCursorA SetWindowLongW SetWindowLongA GetWindowLongW WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetClientRect SetWindowTextW ReleaseDC SetForegroundWindow PostQuitMessage ReleaseCapture SetCapture GetCapture GetKeyState SetFocus BringWindowToTop IsIconic SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow IsChild CreateWindowExA RegisterClassExA DefWindowProcA EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetDesktopWindow GetWindowRect UnregisterClassA wsprintfW GetForegroundWindow UpdateWindow GetDC

gdi32

GetDeviceCaps

oleaut32

SysFreeString

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

d3d9

Direct3DCreate9

shlwapi

SHDeleteKeyW

bcrypt

BCryptGenRandom

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegOpenKeyExW OpenThreadToken RegQueryValueExW RegSetValueExW RegCreateKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey RegOpenKeyW RegEnumValueW

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

7.9MB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

374KB

Virtual Size

373KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.arch

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_981ead9280a05215ca52b6a51ee74905_blankgrabber_glassworm_icedid_njrat_stealc

ole32

ws2_32

crypt32

iphlpapi

secur32

kernel32

user32

gdi32

oleaut32

imm32

d3d9

shlwapi

bcrypt

advapi32

generic