2026-07-30_9c5b000310c8cdb7690b1cc9d29a2aee_glassworm_icedid_njrat_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_9c5b000310c8cdb7690b1cc9d29a2aee_glassworm_icedid_njrat_ryuk_stealc
Size 5.6MB
Sample260730-ftvcfscb83
SHA256 f55df02d9b3279d4a90b26110b39d906b7942b648a923c754cd41aa761b4545c
MD5 9c5b000310c8cdb7690b1cc9d29a2aee
SHA1 3164c37556c729dd1f27c750b8df1d27f5675dff
SHA512 e544b2ef714510619fee7daeef0563c8ac6fd1e0ea6b5f4a6ff13a986ea865e50919707b8b6a8107d6dc7169298a5d6824baf4a0d1f03a3ac8db31ce1f6ead21
SSDEEP 49152:ojrRitaG93566ufb9GuVjuZQ039V9ok+wcBHH/KxcNlfb+ZUHc+Jnw7yiklMSoxy:Ltaq3hudC1UHNLSOwrSo+c/JIjRoVM3
TLSH
T10B566B03F24C90EEC89DC1B5A356523AA7BE784A0320BEDF57D05A116E66ED25F3C760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_9c5b000310c8cdb7690b1cc9d29a2aee_glassworm_icedid_njrat_ryuk_stealc

File Explorer

2026-07-30_9c5b000310c8cdb7690b1cc9d29a2aee_glassworm_icedid_njrat_ryuk_stealc

.exe 5.6MB

2026-07-30_9c5b000310c8cdb7690b1cc9d29a2aee_glassworm_icedid_njrat_ryuk_stealc

IMPHASH 9ebd0e2f641297965ff1faddf9e49402
SHA256 f55df02d9b3279d4a90b26110b39d906b7942b648a923c754cd41aa761b4545c
MD5 9c5b000310c8cdb7690b1cc9d29a2aee
SHA1 3164c37556c729dd1f27c750b8df1d27f5675dff
SHA512 e544b2ef714510619fee7daeef0563c8ac6fd1e0ea6b5f4a6ff13a986ea865e50919707b8b6a8107d6dc7169298a5d6824baf4a0d1f03a3ac8db31ce1f6ead21
SSDEEP 49152:ojrRitaG93566ufb9GuVjuZQ039V9ok+wcBHH/KxcNlfb+ZUHc+Jnw7yiklMSoxy:Ltaq3hudC1UHNLSOwrSo+c/JIjRoVM3
TLSH
T10B566B03F24C90EEC89DC1B5A356523AA7BE784A0320BEDF57D05A116E66ED25F3C760
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2325696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\b\s\w\ir\cache\builder\src\third_party\llvm-build\Release+Asserts\bin\llvm-pdbutil.pdb

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CompareStringW CreateDirectoryW CreateFileMappingW CreateFileW CreateJobObjectW CreateProcessW CreateThread DecodePointer DeleteCriticalSection DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileInformationByHandle GetFileType GetFinalPathNameByHandleW GetLargePageMinimum GetLastError GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformationEx GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessAffinityMask GetProcessGroupAffinity GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetUserDefaultLCID GetVolumePathNameW HeapQueryInformation HeapReAlloc HeapSize HeapValidate HeapWalk InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetProcessMemoryInfo LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenSemaphoreA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ReleaseSemaphore ResumeThread SearchPathW SetConsoleCtrlHandler SetConsoleTextAttribute SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileInformationByHandle SetFilePointerEx SetFileTime SetInformationJobObject SetLastError SetProcessAffinityMask SetStdHandle SetThreadGroupAffinity SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

advapi32

AdjustTokenPrivileges CryptAcquireContextW CryptGenRandom CryptReleaseContext LookupPrivilegeValueW OpenProcessToken RegCloseKey RegGetValueW RegOpenKeyExA

ntdll

RtlCaptureContext RtlGetLastNtStatus RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

45B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

1020B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_9c5b000310c8cdb7690b1cc9d29a2aee_glassworm_icedid_njrat_ryuk_stealc

kernel32

advapi32

ntdll

generic