General
- Target 2026-08-01_a9a19a8cb1ab16c74ce7c010be8fcfbc_glassworm_icedid_njrat_ryuk_stealc
- Size 3.9MB
- Sample260801-mqgerahd65
- SHA256 aa17c058269c289588237466652e3d10b1b1d91d4c4d189c73f646d4f3386c6f
- MD5 a9a19a8cb1ab16c74ce7c010be8fcfbc
- SHA1 fc68c6c713b23c480a75d24d7ab5c3fc48464b13
- SHA512 496490280b98da964aab427c3f699ec4a64c129cfb986729e04014dcb572dd6bc3b27a54400ac6b150f5ff6ac9e201430ad5416d5b9478ce729054d30372fa6b
- SSDEEP 98304:5qfQJvlN/J8c3ioAnxgUuBiFE5fIIIIIIYIIIIIIIIIYIIIIDIIIIIIIIIIIIIIy:i6JTHgwfIIIIIIYIIIIIIIIIYIIIIDIa
- TLSH T1B8169D07F69600D9C41AC2358347E733AA327C885B61A6DF62D47E363EB2AE05F39754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_a9a19a8cb1ab16c74ce7c010be8fcfbc_glassworm_icedid_njrat_ryuk_stealc.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_a9a19a8cb1ab16c74ce7c010be8fcfbc_glassworm_icedid_njrat_ryuk_stealc
- Size 3.9MB
- SHA256 aa17c058269c289588237466652e3d10b1b1d91d4c4d189c73f646d4f3386c6f
- MD5 a9a19a8cb1ab16c74ce7c010be8fcfbc
- SHA1 fc68c6c713b23c480a75d24d7ab5c3fc48464b13
- SHA512 496490280b98da964aab427c3f699ec4a64c129cfb986729e04014dcb572dd6bc3b27a54400ac6b150f5ff6ac9e201430ad5416d5b9478ce729054d30372fa6b
- SSDEEP 98304:5qfQJvlN/J8c3ioAnxgUuBiFE5fIIIIIIYIIIIIIIIIYIIIIDIIIIIIIIIIIIIIy:i6JTHgwfIIIIIIYIIIIIIIIIYIIIIDIa
- TLSH T1B8169D07F69600D9C41AC2358347E733AA327C885B61A6DF62D47E363EB2AE05F39754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1