2026-07-30_f3d5642bc3a5718ae019a212adc8ce1e_blankgrabber_glassworm_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_f3d5642bc3a5718ae019a212adc8ce1e_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 67.6MB
Sample260730-klm1mathrg
SHA256 c642d5f8a39442f763bb681ab885b348f586c56710143878181c2c3b13ac6869
MD5 f3d5642bc3a5718ae019a212adc8ce1e
SHA1 ffcc6c9f4d3bc8c6a3444c3bc4b6522dbb9b3584
SHA512 2c0252a437910b28cd3bbd9bffa2d759dcd52c23d4db8642c6120b626028acff44132d1cc00fee183a17e1ce81b9d02e639313342e6ad717b0805c470c8db267
SSDEEP 786432:97k9ljbmaV1B0XyR/NPRHq0IokDS7TsV7qRK4FEEKmh:9GmafBx/PHqfXucV7qRKaKmh
TLSH
T1BAF7BFD610DADD4AC7364836AAC816D78159EC785F20A123DC3EDF134BE2BE403659AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

themida

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_f3d5642bc3a5718ae019a212adc8ce1e_blankgrabber_glassworm_icedid_luca-stealer_njrat

File Explorer

2026-07-30_f3d5642bc3a5718ae019a212adc8ce1e_blankgrabber_glassworm_icedid_luca-stealer_njrat

.exe 67.6MB

2026-07-30_f3d5642bc3a5718ae019a212adc8ce1e_blankgrabber_glassworm_icedid_luca-stealer_njrat

SHA256 c642d5f8a39442f763bb681ab885b348f586c56710143878181c2c3b13ac6869
MD5 f3d5642bc3a5718ae019a212adc8ce1e
SHA1 ffcc6c9f4d3bc8c6a3444c3bc4b6522dbb9b3584
SHA512 2c0252a437910b28cd3bbd9bffa2d759dcd52c23d4db8642c6120b626028acff44132d1cc00fee183a17e1ce81b9d02e639313342e6ad717b0805c470c8db267
SSDEEP 786432:97k9ljbmaV1B0XyR/NPRHq0IokDS7TsV7qRK4FEEKmh:9GmafBx/PHqfXucV7qRKaKmh
TLSH
T1BAF7BFD610DADD4AC7364836AAC816D78159EC785F20A123DC3EDF134BE2BE403659AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with Themida
Detects executables referencing many IR and analysis tools
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64652810

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

769KB

Virtual Size

769KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

172KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7.9MB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

58.8MB

Virtual Size

58.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_f3d5642bc3a5718ae019a212adc8ce1e_blankgrabber_glassworm_icedid_luca-stealer_njrat

generic