2026-07-30_e006f3eebbf21f45cf32ff36e093c902_glassworm_icedid_njrat_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_e006f3eebbf21f45cf32ff36e093c902_glassworm_icedid_njrat_ryuk_stealc
Size 5.5MB
Sample260730-fgbdtaca44
SHA256 bcac418e4170fdb78de2a98d5b7acc90531e6514b9517058a6dbe6bdb1c57f6b
MD5 e006f3eebbf21f45cf32ff36e093c902
SHA1 5a5b5408831eacd163115a60e1501fe00eb3d7e3
SHA512 6e3a7f0628cd295e2f9b2d662bdc7ac85ba37ae2997c42a689aefa5dfeda2cf9176dad748379f46b04a91b2b2e3572d12016e35d9195b38ffbe44e25006a8a7c
SSDEEP 98304:+o7/XwDTg7kzUk5p3d9tCUSGw8JTJ5R2ZABa:bwIkzUyFtXTgZABa
TLSH
T197465B13F24C91EEC89DC1B5A386523AA7797C4A0320BEDF57D05A116E66ED29F3C360
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_e006f3eebbf21f45cf32ff36e093c902_glassworm_icedid_njrat_ryuk_stealc

File Explorer

2026-07-30_e006f3eebbf21f45cf32ff36e093c902_glassworm_icedid_njrat_ryuk_stealc

.exe 5.5MB

2026-07-30_e006f3eebbf21f45cf32ff36e093c902_glassworm_icedid_njrat_ryuk_stealc

IMPHASH 3f373ffce917e87193aadbab3ca2e47e
SHA256 bcac418e4170fdb78de2a98d5b7acc90531e6514b9517058a6dbe6bdb1c57f6b
MD5 e006f3eebbf21f45cf32ff36e093c902
SHA1 5a5b5408831eacd163115a60e1501fe00eb3d7e3
SHA512 6e3a7f0628cd295e2f9b2d662bdc7ac85ba37ae2997c42a689aefa5dfeda2cf9176dad748379f46b04a91b2b2e3572d12016e35d9195b38ffbe44e25006a8a7c
SSDEEP 98304:+o7/XwDTg7kzUk5p3d9tCUSGw8JTJ5R2ZABa:bwIkzUyFtXTgZABa
TLSH
T197465B13F24C91EEC89DC1B5A386523AA7797C4A0320BEDF57D05A116E66ED29F3C360
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2229200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\b\s\w\ir\cache\builder\src\third_party\llvm-build\Release+Asserts\bin\llvm-pdbutil.pdb

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CompareStringW CreateDirectoryW CreateFileMappingW CreateFileW CreateJobObjectW CreateProcessW CreateThread DecodePointer DeleteCriticalSection DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileInformationByHandle GetFileType GetFinalPathNameByHandleW GetLargePageMinimum GetLastError GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformationEx GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessAffinityMask GetProcessGroupAffinity GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetUserDefaultLCID GetVolumePathNameW HeapQueryInformation HeapReAlloc HeapSize HeapValidate HeapWalk InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetProcessMemoryInfo LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenSemaphoreA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ReleaseSemaphore ResumeThread SearchPathW SetConsoleCtrlHandler SetConsoleTextAttribute SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileInformationByHandle SetFilePointerEx SetFileTime SetInformationJobObject SetLastError SetProcessAffinityMask SetStdHandle SetThreadGroupAffinity SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

advapi32

AdjustTokenPrivileges CryptAcquireContextW CryptGenRandom CryptReleaseContext LookupPrivilegeValueW OpenProcessToken RegCloseKey RegGetValueW RegOpenKeyExA

ntdll

RtlCaptureContext RtlGetLastNtStatus RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

325B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

1020B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_e006f3eebbf21f45cf32ff36e093c902_glassworm_icedid_njrat_ryuk_stealc

kernel32

advapi32

ntdll

generic