2026-08-03_5978223d713d3118a15e8546e3307656_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_5978223d713d3118a15e8546e3307656_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc
Size 2.2MB
Sample260804-nzzs5avyfs
SHA256 ca44ad19a2b4d18f4aec42a3cfc0fea587864ab0742af18d831db5c14caec165
MD5 5978223d713d3118a15e8546e3307656
SHA1 810ca78f357f9766141ee6ed4d82b392f9819640
SHA512 2b0e0609ec97a6c3298a85c074aef830f6ba3b99eca10dcedcc74ed18832b71cd42002e6679b3520236622f0a059aa3275a17cce4fda6bae588f615235ae0c20
SSDEEP 49152:cde26f557sa1Zq9eq7HkYP6yecSrhSD6N50NfSxFYUFnEL9KtBl89:+rSSamWYP6yecSrhiO50aFgLulU
TLSH
T1A4B5AE17A2A801FCD0B7C178CA469A07EB7274091760A6EF13E046A52F636E15FFE753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ClearWinLogs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_5978223d713d3118a15e8546e3307656_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-03_5978223d713d3118a15e8546e3307656_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

.exe 2.2MB

2026-08-03_5978223d713d3118a15e8546e3307656_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 575b0dfdde18cbed6b224fa716453f95
SHA256 ca44ad19a2b4d18f4aec42a3cfc0fea587864ab0742af18d831db5c14caec165
MD5 5978223d713d3118a15e8546e3307656
SHA1 810ca78f357f9766141ee6ed4d82b392f9819640
SHA512 2b0e0609ec97a6c3298a85c074aef830f6ba3b99eca10dcedcc74ed18832b71cd42002e6679b3520236622f0a059aa3275a17cce4fda6bae588f615235ae0c20
SSDEEP 49152:cde26f557sa1Zq9eq7HkYP6yecSrhSD6N50NfSxFYUFnEL9KtBl89:+rSSamWYP6yecSrhiO50aFgLulU
TLSH
T1A4B5AE17A2A801FCD0B7C178CA469A07EB7274091760A6EF13E046A52F636E15FFE753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing commands for clearing Windows Event Logs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1400316

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice

dwmapi

DwmSetWindowAttribute

ole32

CoInitializeEx CoCreateInstance CreateStreamOnHGlobal CoUninitialize

user32

DestroyWindow ShowWindow UpdateLayeredWindow GetAsyncKeyState GetKeyNameTextW MapVirtualKeyW SetTimer KillTimer GetSystemMetrics UpdateWindow GetDC ReleaseDC GetClientRect ScreenToClient MonitorFromPoint GetWindowTextW FindWindowW MessageBeep CreateWindowExW GetActiveWindow GetForegroundWindow MessageBoxW LoadCursorW MessageBoxA OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo RegisterClassExW GetKeyState GetCapture SetCapture UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage ReleaseCapture SetProcessDPIAware ClientToScreen GetCursorPos SetCursor SetCursorPos IsWindowUnicode

gdi32

GetDeviceCaps CreateCompatibleDC DeleteDC DeleteObject SelectObject CreateDIBSection

shell32

SHEmptyRecycleBinW ShellExecuteA ShellExecuteExW SHGetFolderPathW ShellExecuteW SHCreateDirectoryExW

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

winmm

timeEndPeriod PlaySoundA timeBeginPeriod

ws2_32

freeaddrinfo inet_pton inet_ntop getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs ntohl WSAStartup WSACleanup bind connect getpeername getsockname htons recv setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl listen recvfrom sendto ioctlsocket gethostname getaddrinfo WSASetLastError

crypt32

CertCloseStore CertOpenStore CertEnumCertificatesInStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CertFindCertificateInStore CertFreeCertificateContext CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW

advapi32

RegSetValueExW AdjustTokenPrivileges LookupPrivilegeValueW SystemFunction036 CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW ConvertSidToStringSidA RegDeleteKeyA RegCreateKeyExA IsValidSid InitializeAcl GetLengthSid AddAccessAllowedAce ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo SetEntriesInAclW QueryServiceStatus OpenServiceW OpenSCManagerW ControlService CloseServiceHandle ChangeServiceConfigW RegDeleteTreeW AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCloseKey GetTokenInformation FreeSid OpenProcessToken

bcrypt

BCryptGenRandom

psapi

GetModuleInformation

dnsapi

DnsQuery_A DnsFree

wintrust

WinVerifyTrust

wevtapi

EvtClearLog

shlwapi

PathFindFileNameW

kernel32

GetSystemTimeAsFileTime LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable GetFileInformationByHandleEx GetCPInfo AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW SleepConditionVariableSRW GetLocaleInfoEx FormatMessageA TryAcquireSRWLockExclusive InitializeCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW DuplicateHandle GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetConsoleMode ReadConsoleW GetConsoleOutputCP HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CreatePipe GetTimeZoneInformation HeapReAlloc SetStdHandle IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize VerifyVersionInfoW WaitForMultipleObjects PeekNamedPipe GetFileType GetStringTypeW UnhandledExceptionFilter WriteConsoleW GetModuleHandleW GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx SleepEx LoadLibraryW DeleteCriticalSection GetFileAttributesA GetFileAttributesW QueryPerformanceCounter QueryPerformanceFrequency Sleep ExitProcess GetTickCount64 GetModuleFileNameW RtlUnwind GetProcAddress LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MulDiv WideCharToMultiByte IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle GetCurrentProcess TerminateProcess GetCurrentThread GetThreadContext CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLastError FlushInstructionCache OpenProcess GetSystemInfo VirtualAllocEx VirtualProtectEx VirtualQueryEx ReadProcessMemory WriteProcessMemory VirtualFreeEx K32EnumProcessModules K32GetModuleBaseNameW K32GetModuleInformation DeleteFileA GetModuleFileNameA ExpandEnvironmentStringsW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileSize GetFileSizeEx GetLogicalDriveStringsW ReadFile RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointer SetFilePointerEx WriteFile GetTempPathW FindFirstStreamW FindNextStreamW WaitForSingleObject GetCurrentProcessId GetExitCodeProcess CreateThread CreateProcessW GetTickCount GetSystemDirectoryW GetWindowsDirectoryW LocalFree MoveFileExW MultiByteToWideChar GetConsoleWindow AddVectoredExceptionHandler GetCurrentThreadId VirtualProtect CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleHandleA AddDllDirectory SetDefaultDllDirectories QueryFullProcessImageNameW SetDllDirectoryW OutputDebugStringA VerSetConditionMask FreeLibrary LoadLibraryA GetLocaleInfoA IsDBCSLeadByte SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx

d3dcompiler_47

D3DCompile

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

400KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

211KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_5978223d713d3118a15e8546e3307656_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

d3d11

dwmapi

ole32

user32

gdi32

shell32

imm32

winmm

ws2_32

crypt32

advapi32

bcrypt

psapi

dnsapi

wintrust

wevtapi

shlwapi

kernel32

d3dcompiler_47

generic