2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc
Size 3.9MB
Sample260801-mfbfraseng
SHA256 be82981cbeee9b9ba2f666210b071ce908c2c6a7231d7ad63f638c6608958a14
MD5 ee08387e2e4806c004e93d4424bc64a9
SHA1 ce982e0d591c4142fe08f625e3e598123442cdb7
SHA512 f9dbc970c36e63cbd60f240d296d6989e50f7c83ac9f06e8d56d5a07e50f9f06e7ea061bf0a3fc22502b7f14bcd04a505bd78b63430f48ef342765d174dc005e
SSDEEP 98304:BqfQJvlN/J8c3ioAnxgUuBiFE5fIIIIIIYIIIIIIIIIYIIIIDIIIIIIIIIIIIIIy:K6JTHgwfIIIIIIYIIIIIIIIIYIIIIDIa
TLSH
T184169D07F69600D9C41AC2358347E733AA327C885B61A6DF62D47E363EB2AE05F39754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc

File Explorer

2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc

.exe 3.9MB

2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc

IMPHASH b20b296abaa754e7117c889ac68ea3c3
SHA256 be82981cbeee9b9ba2f666210b071ce908c2c6a7231d7ad63f638c6608958a14
MD5 ee08387e2e4806c004e93d4424bc64a9
SHA1 ce982e0d591c4142fe08f625e3e598123442cdb7
SHA512 f9dbc970c36e63cbd60f240d296d6989e50f7c83ac9f06e8d56d5a07e50f9f06e7ea061bf0a3fc22502b7f14bcd04a505bd78b63430f48ef342765d174dc005e
SSDEEP 98304:BqfQJvlN/J8c3ioAnxgUuBiFE5fIIIIIIYIIIIIIIIIYIIIIDIIIIIIIIIIIIIIy:K6JTHgwfIIIIIIYIIIIIIIIIYIIIIDIa
TLSH
T184169D07F69600D9C41AC2358347E733AA327C885B61A6DF62D47E363EB2AE05F39754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1899768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

opengl32

glBindTexture glClear glClearColor glFinish glGenTextures glGetIntegerv glGetString glPixelStorei glTexImage2D glTexParameteri glViewport wglGetCurrentDC wglGetProcAddress

dwmapi

DwmExtendFrameIntoClientArea

winmm

timeBeginPeriod timeEndPeriod

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGenRandom BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptDestroyKey CryptEncrypt CryptGetHashParam CryptHashData CryptImportKey CryptReleaseContext RegCloseKey RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW

kernel32

AcquireSRWLockExclusive AllocConsole AreFileApisANSI CloseHandle CompareStringW CreateDirectoryW CreateFile2 CreateFileA CreateFileMappingW CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetCompressedFileSizeW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemTimeAsFileTime GetTempPathW GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess PeekNamedPipe Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetLastError SetStdHandle SetThreadExecutionState SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualProtect WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

user32

AdjustWindowRectEx BringWindowToTop CallWindowProcW ChangeDisplaySettingsExW ClientToScreen ClipCursor CloseClipboard CreateIconIndirect CreateWindowExW DefWindowProcW DestroyIcon DestroyWindow DispatchMessageW EmptyClipboard EnumDisplayDevicesW EnumDisplayMonitors EnumDisplaySettingsExW EnumDisplaySettingsW FlashWindow GetActiveWindow GetClassLongPtrW GetClientRect GetClipboardData GetCursorPos GetDC GetKeyState GetLayeredWindowAttributes GetMessageExtraInfo GetMessageTime GetMonitorInfoW GetPropA GetPropW GetRawInputData GetRawInputDeviceInfoA GetRawInputDeviceList GetSystemMetrics GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect IsIconic IsWindowVisible IsZoomed LoadCursorW LoadImageW MapVirtualKeyW MessageBoxA MonitorFromWindow MoveWindow MsgWaitForMultipleObjects OffsetRect OpenClipboard PeekMessageW PostMessageW PtInRect RegisterClassExW RegisterDeviceNotificationW RegisterRawInputDevices ReleaseCapture ReleaseDC RemovePropW ScreenToClient SendMessageW SetCapture SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetPropA SetPropW SetRect SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW ToUnicode TrackMouseEvent TranslateMessage UnregisterClassW UnregisterDeviceNotification WaitMessage WindowFromPoint

shell32

DragAcceptFiles DragFinish DragQueryFileW DragQueryPoint ShellExecuteA ShellExecuteW

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

gdi32

ChoosePixelFormat CreateBitmap CreateDCW CreateDIBSection CreateRectRgn DeleteDC DeleteObject DescribePixelFormat GetDeviceCaps GetDeviceGammaRamp SetDeviceGammaRamp SetPixelFormat SwapBuffers

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetLastError WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt htonl htons inet_ntop inet_pton ioctlsocket listen ntohs recv select send setsockopt socket

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateChainEngine CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetNameStringW CertOpenStore CryptDecodeObjectEx CryptQueryObject CryptStringToBinaryW PFXImportCertStore

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

45B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

171KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc

opengl32

dwmapi

winmm

bcrypt

advapi32

kernel32

user32

shell32

ole32

imm32

gdi32

ws2_32

crypt32

generic