2026-07-27_aedf9c53b10161ebbad78faba07abf34_akira_amadey_blankgrabber_darkgate_glassworm_icedid_luca-stealer_njrat_rhadamanthys_rusty-stealer_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_aedf9c53b10161ebbad78faba07abf34_akira_amadey_blankgrabber_darkgate_glassworm_icedid_luca-stealer_njrat_rhadamanthys_rusty-stealer_stealc_stop
Size 10.0MB
Sample260727-vy2dwsap9x
SHA256 2b945bc130742c40b5ed0b3e6b536a46511d3c2283c35874fd15528bf1fe283a
MD5 aedf9c53b10161ebbad78faba07abf34
SHA1 54d3c61805583cccb87e66dc3b21faae1aef23c6
SHA512 8f552d98783f700c145477b3d2a563d74ed7bd9bacba6519aa38f2d4af6bb0c2deea670d3ca58ae0430d336823800f88f997ec495db7b88fa3df849b7524edf2
SSDEEP 196608:PCNEO3GQPDD3mOrI2iFtJfh2mqRbR+0XD12S1wOBzWI+/GjuQrSsfDcdGNCM8gD:PCjGGDD3mOrI2iFtJfh2mqd+eD4GBzWC
TLSH
T14DB6BE02E553F03AD50201B0599EE37DAF246A144B218EEB9BE4DFFC1B26AC4257F716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_aedf9c53b10161ebbad78faba07abf34_akira_amadey_blankgrabber_darkgate_glassworm_icedid_luca-stealer_njrat_rhadamanthys_rusty-stealer_stealc_stop

File Explorer

2026-07-27_aedf9c53b10161ebbad78faba07abf34_akira_amadey_blankgrabber_darkgate_glassworm_icedid_luca-stealer_njrat_rhadamanthys_rusty-stealer_stealc_stop

.exe 10.0MB

2026-07-27_aedf9c53b10161ebbad78faba07abf34_akira_amadey_blankgrabber_darkgate_glassworm_icedid_luca-stealer_njrat_rhadamanthys_rusty-stealer_stealc_stop

IMPHASH c658e06bf3595fb23541d4ddfb64c065
SHA256 2b945bc130742c40b5ed0b3e6b536a46511d3c2283c35874fd15528bf1fe283a
MD5 aedf9c53b10161ebbad78faba07abf34
SHA1 54d3c61805583cccb87e66dc3b21faae1aef23c6
SHA512 8f552d98783f700c145477b3d2a563d74ed7bd9bacba6519aa38f2d4af6bb0c2deea670d3ca58ae0430d336823800f88f997ec495db7b88fa3df849b7524edf2
SSDEEP 196608:PCNEO3GQPDD3mOrI2iFtJfh2mqRbR+0XD12S1wOBzWI+/GjuQrSsfDcdGNCM8gD:PCjGGDD3mOrI2iFtJfh2mqd+eD4GBzWC
TLSH
T14DB6BE02E553F03AD50201B0599EE37DAF246A144B218EEB9BE4DFFC1B26AC4257F716
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

350136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

shell32

ShellExecuteW ShellExecuteA

dwmapi

DwmExtendFrameIntoClientArea

user32

LoadCursorA ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState DefWindowProcW GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadIconA ScreenToClient GetCursorPos UpdateWindow ShowWindow DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassA PostQuitMessage DefWindowProcA PeekMessageA DispatchMessageA TranslateMessage EmptyClipboard

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers OutputDebugStringW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree ExitProcess WriteConsoleW GetModuleFileNameW GetFileType SetCurrentDirectoryA CreateDirectoryA CreateFileA GetFileAttributesA WriteFile GetTempPathA CloseHandle LoadResource LockResource SizeofResource FindResourceA ReadFile SetHandleInformation CreatePipe WaitForSingleObject Sleep GetExitCodeProcess CreateProcessA OutputDebugStringA HeapSize GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetStdHandle SetStdHandle GetStringTypeW GetProcessHeap GlobalUnlock CreateFileW HeapReAlloc SetEndOfFile GlobalAlloc RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

490KB

Virtual Size

490KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

189KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9.3MB

Virtual Size

9.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_aedf9c53b10161ebbad78faba07abf34_akira_amadey_blankgrabber_darkgate_glassworm_icedid_luca-stealer_njrat_rhadamanthys_rusty-stealer_stealc_stop

d3d11

d3dcompiler_47

shell32

dwmapi

user32

kernel32

imm32

generic