2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc
Size 9.8MB
Sample260718-nwwmasdw21
SHA256 d645a2f4d04510b330fdb43dd46cd059904c0a22e8f336e8778044bad5297cfc
MD5 21a725ab9c6cfdcba2b63da1f9f3c91a
SHA1 26e47828fa4b7d8403cf70131adf007644d98f25
SHA512 98377157f8fe45daa6948ff77e5729189f30bb85a38a9ad58ab6dc3ee18b7b549b01e56c2ad0568a3d2fbc7ca5e6f9b33dcbf2f6d248d38092b00355f63333da
SSDEEP 98304:QvuVDi1tFeE7y/NMZoC/I/EEvZqKG2BTLO4IqVxpHar5oZ/+/U2VBExZF8R05ZU:XV03+/aiC/SEGBBTLO4bVxpHw5IuEx8
TLSH
T18FA69D12AE542C8DC066D632D7508A190DF435D5879919DFC1CC2AEE0E2EEE7AB3C63D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc

File Explorer

2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc

.exe 9.8MB

2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc

IMPHASH 5a46e7e1e8ced48ee56a7f26d6856b71
SHA256 d645a2f4d04510b330fdb43dd46cd059904c0a22e8f336e8778044bad5297cfc
MD5 21a725ab9c6cfdcba2b63da1f9f3c91a
SHA1 26e47828fa4b7d8403cf70131adf007644d98f25
SHA512 98377157f8fe45daa6948ff77e5729189f30bb85a38a9ad58ab6dc3ee18b7b549b01e56c2ad0568a3d2fbc7ca5e6f9b33dcbf2f6d248d38092b00355f63333da
SSDEEP 98304:QvuVDi1tFeE7y/NMZoC/I/EEvZqKG2BTLO4IqVxpHar5oZ/+/U2VBExZF8R05ZU:XV03+/aiC/SEGBBTLO4bVxpHw5IuEx8
TLSH
T18FA69D12AE542C8DC066D632D7508A190DF435D5879919DFC1CC2AEE0E2EEE7AB3C63D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7122516

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AreFileApisANSI CloseHandle CloseThreadpoolWork CompareStringW CopyFileW CreateDirectoryA CreateDirectoryW CreateFileA CreateFileMappingW CreateFileW CreateMutexW CreatePipe CreateProcessW CreateThread CreateThreadpoolWork CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeLibraryWhenCallbackReturns GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoA GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemFirmwareTable GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetTickCount GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GlobalFindAtomA GlobalLock GlobalUnlock HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetProcessMemoryInfo LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockResource MapViewOfFile Module32FirstW Module32NextW MoveFileExW MulDiv MultiByteToWideChar OpenProcess OutputDebugStringW PeekNamedPipe Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseSRWLockExclusive RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryA SetEndOfFile SetEnvironmentVariableW SetFileAttributesA SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SleepEx SubmitThreadpoolWork SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualProtectEx VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

user32

BeginPaint ClientToScreen CloseClipboard CreateWindowExA CreateWindowExW DefWindowProcA DefWindowProcW DestroyWindow DispatchMessageA DispatchMessageW DrawTextA EmptyClipboard EndPaint FillRect FindWindowW GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageA GetMessageExtraInfo GetSystemMetrics GetWindowRect IsIconic IsWindowUnicode LoadCursorW LoadIconW LoadImageW MessageBoxA MonitorFromWindow OpenClipboard PeekMessageW PostMessageW PostQuitMessage RegisterClassA RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SendMessageA SendMessageW SetCapture SetCursor SetCursorPos SetForegroundWindow SetProcessDPIAware SetWindowDisplayAffinity SetWindowPos ShowWindow TrackMouseEvent TranslateMessage UnregisterClassW UpdateWindow WaitMessage

gdi32

CreateFontA CreateFontW CreateSolidBrush DeleteObject GetDeviceCaps GetStockObject SelectObject SetBkColor SetBkMode SetTextColor

advapi32

AddAccessAllowedAce CloseServiceHandle ControlService CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptDestroyKey CryptEncrypt CryptGetHashParam CryptHashData CryptImportKey CryptReleaseContext GetLengthSid GetTokenInformation GetUserNameA InitializeAcl IsValidSid OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegGetValueW RegOpenKeyExA RegQueryValueExA RegSetValueExA SetSecurityInfo StartServiceW SystemFunction036

shell32

CommandLineToArgvW ord680 SHGetFolderPathW SHGetKnownFolderPath ShellExecuteA ShellExecuteExA ShellExecuteW

ole32

CoCreateInstance CoInitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoTaskMemFree CoUninitialize

oleaut32

SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound SysAllocString SysAllocStringByteLen SysFreeString SysStringByteLen VariantClear VariantInit

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

d3d9

Direct3DCreate9

comctl32

ord345

wininet

DeleteUrlCacheEntryA HttpQueryInfoA InternetCloseHandle InternetOpenA InternetOpenUrlA InternetOpenUrlW InternetOpenW InternetReadFile

bcrypt

BCryptGenRandom

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateChainEngine CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetNameStringW CertOpenStore CryptBinaryToStringA CryptDecodeObjectEx CryptQueryObject CryptStringToBinaryA CryptStringToBinaryW PFXImportCertStore

uxtheme

SetWindowTheme

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

shlwapi

PathFindFileNameW

httpapi

HttpAddUrlToUrlGroup HttpCreateRequestQueue HttpCreateServerSession HttpCreateUrlGroup HttpInitialize HttpReceiveHttpRequest HttpSendHttpResponse HttpSetUrlGroupProperty

psapi

GetModuleInformation

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetLastError WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostname getpeername getsockname getsockopt htonl htons inet_ntop inet_pton ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt socket

Name

.text

Size

7.0MB

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

638KB

Virtual Size

638KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

742KB

Virtual Size

814KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

169KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

512B

Virtual Size

216B

Characteristics

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

dwmapi

d3d9

comctl32

wininet

bcrypt

crypt32

uxtheme

api-ms-win-shcore-scaling-l1-1-1

shlwapi

httpapi

psapi

ws2_32

generic