2026-08-03_0522eed5bf2ff430aec9bc49e346ff90_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_0522eed5bf2ff430aec9bc49e346ff90_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc
Size 19.6MB
Sample260803-fxfngayhnd
SHA256 57378d9b9744b6f60ec861bf842ef7a978748b61fbfb5769ed4b26b511d9b01d
MD5 0522eed5bf2ff430aec9bc49e346ff90
SHA1 bad7123315a958497a1c823bcdc604fab86e852e
SHA512 ab4c242f6341d99aca65e69a0cbfc383d517301e81696ca4a66c2c50559cc15fea5e118f5c20113fc1c1d1caa13f2e980397fac250ef0225f2d76700cfbd8430
SSDEEP 196608:uLe/Nn5IttXMhpqnbsjuZZLH1JTItpXT6U0XK7h/JbhXUMdiRqEF9:Z/QchpqnbsjuZBnTItp6Uf7RTU79
TLSH
T19327AF1662F801E8E0B7D179CA529907EB72785943F197DF06A482F60F33AE44E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_0522eed5bf2ff430aec9bc49e346ff90_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-03_0522eed5bf2ff430aec9bc49e346ff90_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

.exe 19.6MB

2026-08-03_0522eed5bf2ff430aec9bc49e346ff90_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH f4eb08091489d804ca315387fec33ebe
SHA256 57378d9b9744b6f60ec861bf842ef7a978748b61fbfb5769ed4b26b511d9b01d
MD5 0522eed5bf2ff430aec9bc49e346ff90
SHA1 bad7123315a958497a1c823bcdc604fab86e852e
SHA512 ab4c242f6341d99aca65e69a0cbfc383d517301e81696ca4a66c2c50559cc15fea5e118f5c20113fc1c1d1caa13f2e980397fac250ef0225f2d76700cfbd8430
SSDEEP 196608:uLe/Nn5IttXMhpqnbsjuZZLH1JTItpXT6U0XK7h/JbhXUMdiRqEF9:Z/QchpqnbsjuZBnTItp6Uf7RTU79
TLSH
T19327AF1662F801E8E0B7D179CA529907EB72785943F197DF06A482F60F33AE44E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Patched UPX-packed file

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9414980

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\bamboo-agent-home\xml-data\build-dir\SH5-RC-JOB1\sh5\builds\Release-x64\ShKernel.pdb

ws2_32

WSAGetLastError WSAStartup WSACleanup WSAEnumNetworkEvents WSAEnumProtocolsW WSAAddressToStringW WSCDeinstallProvider shutdown getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr gethostbyname gethostname ioctlsocket WSAIoctl getpeername recvfrom sendto getaddrinfo freeaddrinfo accept bind closesocket listen getsockname socket connect recv htonl setsockopt __WSAFDIsSet select WSASetLastError htons ntohs WSACloseEvent WSACreateEvent WSAEventSelect WSAResetEvent send WSAWaitForMultipleEvents getsockopt

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

gdiplus

GdipBitmapUnlockBits GdipCreateBitmapFromHICON GdipCloneImage GdipDisposeImage GdipCreateBitmapFromScan0 GdiplusStartup GdiplusShutdown GdipFillRectangleI GdipDrawImageRectRectI GdipBitmapLockBits GdipAlloc GdipFree GdipDeleteBrush GdipGetImageWidth GdipGetImageHeight GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipGetImageGraphicsContext GdipDeleteGraphics GdipCreateSolidFill

user32

OemToCharBuffA CharUpperW CharLowerW LoadStringW GetProcessWindowStation GetUserObjectInformationW MessageBoxW wsprintfW CharToOemA GetSystemMetrics CreateIconFromResourceEx DestroyIcon IsCharAlphaNumericA BroadcastSystemMessageW OemToCharA ExitWindowsEx

kernel32

GetFileAttributesExW FileTimeToLocalFileTime GetFileSize ReleaseSRWLockExclusive AcquireSRWLockExclusive GetFullPathNameW VerSetConditionMask GetModuleHandleW VerifyVersionInfoW GetEnvironmentVariableA GetSystemTimeAsFileTime CreateThread ReadFile GetStdHandle PeekNamedPipe GetFileType SleepEx GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualAlloc VirtualProtect VirtualFree VirtualLock GetACP GetSystemDirectoryA LoadLibraryA RtlVirtualUnwind TryEnterCriticalSection GetExitCodeThread GetTimeFormatW GetDateFormatW SystemTimeToTzSpecificLocalTime CreateTimerQueue DeleteTimerQueueEx GetUserDefaultLCID GetStringTypeExW LCMapStringW GetSystemWow64DirectoryW lstrlenW FindFirstFileExW CopyFileW lstrcmpiW GetDiskFreeSpaceW LocalAlloc GetVersionExW GetNativeSystemInfo ProcessIdToSessionId GetComputerNameW CreatePipe SetHandleInformation GetExitCodeProcess HeapReAlloc GetCurrentThread GetModuleHandleA GlobalAlloc GlobalLock GlobalUnlock GlobalFree RtlCaptureContext RemoveVectoredExceptionHandler SetUnhandledExceptionFilter AddVectoredExceptionHandler IsBadReadPtr CreateFileMappingW MapViewOfFile UnmapViewOfFile SetFilePointer K32EnumProcesses CreateToolhelp32Snapshot Thread32First Thread32Next GetProcessHandleCount QueryDosDeviceW K32GetProcessImageFileNameW QueryFullProcessImageNameW Module32FirstW OpenThread InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList FindResourceW SizeofResource LoadResource LockResource FreeResource EnumResourceNamesW GetLocaleInfoW Process32FirstW Process32NextW Module32NextW FindFirstVolumeW GetVolumePathNamesForVolumeNameW FindNextVolumeW FindVolumeClose K32EnumProcessModules SetFilePointerEx MoveFileA GetFileAttributesExA FindFirstFileA ReplaceFileA FindNextFileA LockFile GetTempPathA GetFileAttributesA CreateFileA DeleteFileA UnlockFile CreateFileMappingA RemoveDirectoryA CreateDirectoryA GetTimeZoneInformation TzSpecificLocalTimeToSystemTime lstrcmpW GetFileTime GetTempPathW SwitchToThread GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort GetSystemDirectoryW ResumeThread WTSGetActiveConsoleSessionId DisconnectNamedPipe CancelIoEx DuplicateHandle MapViewOfFileEx TryAcquireSRWLockExclusive GetStringTypeW FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork WritePrivateProfileStringW GetModuleHandleExW GetUserDefaultLangID WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW RtlPcToFileHeader RaiseException InitOnceBeginInitialize InitOnceComplete GetVolumeInformationW EncodePointer GetLocaleInfoEx LCMapStringEx CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait CompareStringEx GetCPInfo ResetEvent OpenEventA CreateWaitableTimerA RtlLookupFunctionEntry UnhandledExceptionFilter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetFileAttributesW GetLongPathNameW GlobalMemoryStatusEx GetSystemInfo GetProcessTimes K32GetModuleFileNameExW GetPriorityClass OpenProcess GetSystemTimes GetDriveTypeW GetLogicalDriveStringsW GetLocalTime GetSystemTime OpenMutexW SetWaitableTimer CreateWaitableTimerW GetSystemPowerStatus SetThreadExecutionState GetTickCount64 GetCurrentProcessId OutputDebugStringW TerminateProcess WaitForMultipleObjects ConnectNamedPipe CreateNamedPipeW K32GetProcessMemoryInfo ReleaseMutex CompareFileTime CreateMutexW CreateEventW SetCurrentDirectoryW GetCurrentThreadId WaitForSingleObject EnterCriticalSection LeaveCriticalSection InitializeCriticalSection MoveFileExW FreeLibrary GetProcAddress LoadLibraryW CreateFileW GetCurrentProcess DeleteTimerQueueTimer CreateTimerQueueTimer DecodePointer DeleteCriticalSection InitializeCriticalSectionEx CreateProcessW QueryPerformanceFrequency QueryPerformanceCounter GetLastError SetEvent CreateEventA HeapAlloc WaitForMultipleObjectsEx HeapFree GetProcessHeap GetTickCount Sleep WaitForSingleObjectEx CreateSemaphoreA ReleaseSemaphore CloseHandle FormatMessageA FormatMessageW LocalFree WideCharToMultiByte SetThreadGroupAffinity GetThreadGroupAffinity GetNumaHighestNodeNumber GetLogicalProcessorInformationEx GetCurrentProcessorNumberEx GetThreadPriority SetThreadPriority SignalObjectAndWait FreeLibraryAndExitThread GetThreadTimes QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList RtlUnwindEx InitializeCriticalSectionAndSpinCount ExitThread GetFileInformationByHandle GetConsoleOutputCP SetConsoleCtrlHandler ExitProcess GetShortPathNameW CreateSemaphoreW CompareStringA FoldStringW GetPrivateProfileStringW IsDBCSLeadByte RtlUnwind GetProfileStringW WriteProfileStringW FindClose FindNextFileW FindFirstFileW SetLastError MultiByteToWideChar CreateDirectoryW WriteConsoleW SetStdHandle GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue IsProcessorFeaturePresent GetModuleFileNameW FlsFree LoadLibraryExW RemoveDirectoryW GetDiskFreeSpaceExW DeleteFileW MoveFileW SetFileAttributesW WriteFile GetFileSizeEx BackupSeek BackupRead FlushFileBuffers SearchPathW lstrcpyW FileTimeToSystemTime SystemTimeToFileTime ExpandEnvironmentStringsW DeviceIoControl CloseThreadpoolWork SetErrorMode CompareStringW IsValidLocale EnumSystemLocalesW IsValidCodePage GetOEMCP GetWindowsDirectoryW SetEnvironmentVariableW GetCurrentDirectoryW SetEndOfFile GetEnvironmentStringsW FreeEnvironmentStringsW CreateHardLinkW ReadProcessMemory VirtualQueryEx SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CopyFileA GetTempFileNameA MoveFileExA GetLocaleInfoA VirtualUnlock LockFileEx HeapDestroy HeapCompact FlushViewOfFile GetDiskFreeSpaceA HeapValidate UnlockFileEx GetFullPathNameA OutputDebugStringA HeapCreate AreFileApisANSI GetModuleFileNameA GetLogicalDrives HeapSize GetProcessAffinityMask

advapi32

CryptReleaseContext RegOpenKeyW IsTextUnicode RegReplaceKeyW RegSaveKeyW GetNumberOfEventLogRecords ClearEventLogW RegUnLoadKeyW RegLoadKeyW DecryptFileW FileEncryptionStatusW EnumServicesStatusExW DeleteAce GetAce CreateProcessAsUserW DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf ReadEventLogW OpenEventLogW CloseEventLog CreateServiceW StartServiceW ChangeServiceConfigW RegSaveKeyExW LookupAccountNameW RegSetKeySecurity ControlService QueryServiceStatusEx IsValidSecurityDescriptor SetSecurityDescriptorOwner SetSecurityDescriptorDacl AddAccessAllowedAce GetLengthSid InitializeSecurityDescriptor AllocateAndInitializeSid OpenThreadToken FreeSid CheckTokenMembership GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW ConvertSidToStringSidW EqualSid GetTokenInformation SetNamedSecurityInfoW SetEntriesInAclW InitializeAcl GetExplicitEntriesFromAclW GetNamedSecurityInfoW CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptGenRandom ReportEventW RegisterEventSourceW DeregisterEventSource CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptDestroyKey CryptAcquireContextW CryptEncrypt CryptImportKey SetFileSecurityW RegQueryInfoKeyW QueryServiceConfigW EnumServicesStatusW CloseServiceHandle DeleteService OpenServiceW OpenSCManagerW RegEnumKeyExW RegFlushKey RegEnumValueW RegDeleteValueW RegSetValueExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW ConvertStringSecurityDescriptorToSecurityDescriptorW ChangeServiceConfig2W QueryServiceConfig2A OpenProcessToken

ole32

CoInitialize CoSetProxyBlanket CoUninitialize CoInitializeSecurity StgOpenStorageOnILockBytes StgIsStorageILockBytes CreateILockBytesOnHGlobal CreateStreamOnHGlobal CoCreateInstance StringFromCLSID CoTaskMemFree CoInitializeEx

shell32

SHGetSpecialFolderPathW SHFileOperationW SHCreateItemFromParsingName ShellExecuteExW SHChangeNotify

oleaut32

SysStringLen SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement SafeArrayDestroy SysFreeString VariantChangeType SysAllocString VariantInit VariantClear

shlwapi

StrCmpNIW SHDeleteKeyW PathFileExistsW ord1 SHCopyKeyW

mpr

WNetGetConnectionW

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenerateKeyPair BCryptFinalizeKeyPair BCryptSignHash BCryptExportKey BCryptImportKeyPair BCryptVerifySignature

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW

crypt32

CertDuplicateCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW CertFindCertificateInStore CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CryptMsgClose CertOpenSystemStoreA CertGetIntendedKeyUsage

wininet

InternetSetOptionW

iphlpapi

GetAdaptersAddresses

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

authz

AuthzAccessCheck AuthzFreeResourceManager AuthzInitializeContextFromSid AuthzInitializeResourceManager AuthzFreeContext

pdh

PdhCollectQueryData PdhAddCounterW PdhGetFormattedCounterValue PdhOpenQueryW PdhGetRawCounterValue PdhLookupPerfNameByIndexW PdhCloseQuery

powrprof

CallNtPowerInformation SetSuspendState

cabinet

ord23 ord22 ord20

Name

.text

Size

13.7MB

Virtual Size

13.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

680KB

Virtual Size

864KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

549KB

Virtual Size

549KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

241KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

664KB

Virtual Size

668KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=236, id=261, version=33145,

count=25, id=259, version=33145,

count=1, id=260, version=25203,

count=14, id=253, version=35207,

count=20, id=260, version=35207,

count=3, id=261, version=35222,

count=14, id=259, version=35207,

count=157, id=261, version=35207,

count=2, id=259, version=35223,

count=728, id=260, version=35217,

count=29, productName=Unmarked objects (old),

count=43, id=261, version=35223,

count=3, id=262, version=33145,

count=1, id=263, version=33145,

count=62, id=260, version=33145,

count=47, id=257, version=33145,

count=672, id=1, productName=Unmarked objects,

count=1332, id=265, version=35223,

count=1, id=255, version=35223,

count=1, id=151,

count=1, id=258, version=35223,