2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk
Size 1.2MB
Sample260803-ry24mss1ct
SHA256 3da1cc0e4935c81041e1e27195166f269d6c3fdc2b0924d5fe877d34fe48c40a
MD5 6427265fcaed0f231c0ed0da6d881176
SHA1 b72e456ba60138e702302846d34ce3e8aeafbc2f
SHA512 d5869c3d93afd0a284136fbe241cafb7e1fb193bcc002332136f0c81a9ce37df41db420a61f2b3f67041408be82375651f4e1b19bcf5fb75a94ce63c2ecf6439
SSDEEP 24576:a2AoRP0A4RBajzrxTqN0Yck0LZmmNRnQ/tbw/2Mkjy6Fr7g0o4:a2AohYBajzrxqXcNRQ/lFTjN4
TLSH
T16B45C017B39404F8D06AC27ACB664112EBB2F4850A75BB9F13A447252F37B985F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk

File Explorer

2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk

.exe 1.2MB

2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk

IMPHASH 470ad2d172b4461a335182df8b98a31a
SHA256 3da1cc0e4935c81041e1e27195166f269d6c3fdc2b0924d5fe877d34fe48c40a
MD5 6427265fcaed0f231c0ed0da6d881176
SHA1 b72e456ba60138e702302846d34ce3e8aeafbc2f
SHA512 d5869c3d93afd0a284136fbe241cafb7e1fb193bcc002332136f0c81a9ce37df41db420a61f2b3f67041408be82375651f4e1b19bcf5fb75a94ce63c2ecf6439
SSDEEP 24576:a2AoRP0A4RBajzrxTqN0Yck0LZmmNRnQ/tbw/2Mkjy6Fr7g0o4:a2AohYBajzrxqXcNRQ/lFTjN4
TLSH
T16B45C017B39404F8D06AC27ACB664112EBB2F4850A75BB9F13A447252F37B985F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

341472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid CopySid EqualSid GetLengthSid GetUserNameA InitializeSecurityDescriptor RegCloseKey RegCreateKeyA RegOpenKeyA RegQueryValueExA RegSetValueExA SetSecurityDescriptorDacl SetSecurityDescriptorOwner

user32

FindWindowA GetCapture GetClipboardOwner GetCursorPos GetForegroundWindow GetQueueStatus SendMessageA

kernel32

CloseHandle CompareStringW ConnectNamedPipe CreateDirectoryA CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeA CreatePipe CreateProcessA CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileA FindFirstFileExA FindNextFileA FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableA GetExitCodeProcess GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileSize GetFileTime GetFileType GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemTimeAsFileTime GetThreadTimes GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetWindowsDirectoryA GlobalMemoryStatus HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LocalAlloc LocalFileTimeToFileTime LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleMode SetCurrentDirectoryA SetEndOfFile SetEnvironmentVariableA SetEvent SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeA WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

481KB

Virtual Size

480KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk

advapi32

user32

kernel32

generic