2026-08-03_3f0dd224525dbe75d662a75c72c5f55c_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_3f0dd224525dbe75d662a75c72c5f55c_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc
Size 18.7MB
Sample260804-phbkmswway
SHA256 30253e6beb1570a7366949ff3c46b74a76d758ffedd9f15470f9172fb32cd2d3
MD5 3f0dd224525dbe75d662a75c72c5f55c
SHA1 16b41771da71b830a3c3e6cce2220ee1cb2085c7
SHA512 a37e786285d9c0792c4c662402737497bcf7e2a483e75a1b1ba2de51c7e10be39897b782f4efab6693c8a0ae6276fbc99a6758e0a02373e6d710b78806c77c84
SSDEEP 196608:UzcvLrccXsTn80VcduAwFTBuVoUp0vJVoYeRVFknD8Le:UIdsTjcdSrJVoYArLe
TLSH
T10D179E17B1E801DCD0BAD179CA9B8907EBB1B80903B15BDB06D085A92F77EE06D7D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-03_3f0dd224525dbe75d662a75c72c5f55c_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

.exe 18.7MB

2026-08-03_3f0dd224525dbe75d662a75c72c5f55c_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 878182787517b9707914f1cc268e96e0
SHA256 30253e6beb1570a7366949ff3c46b74a76d758ffedd9f15470f9172fb32cd2d3
MD5 3f0dd224525dbe75d662a75c72c5f55c
SHA1 16b41771da71b830a3c3e6cce2220ee1cb2085c7
SHA512 a37e786285d9c0792c4c662402737497bcf7e2a483e75a1b1ba2de51c7e10be39897b782f4efab6693c8a0ae6276fbc99a6758e0a02373e6d710b78806c77c84
SSDEEP 196608:UzcvLrccXsTn80VcduAwFTBuVoUp0vJVoYeRVFknD8Le:UIdsTjcdSrJVoYArLe
TLSH
T10D179E17B1E801DCD0BAD179CA9B8907EBB1B80903B15BDB06D085A92F77EE06D7D712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

42:27:35:87:e4:8c:ce:28:38:77:0d:fe:ec:d3:6f:24:61:e5:fe:d0:e7:96:65:da:ff:ef:f1:9f:65:93:e7:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

Chains

Jul 21, 2026

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=TeamViewer Germany GmbH,O=TeamViewer Germany GmbH,L=Göppingen,C=DE

Serial Number

04:7d:f4:69:4f:cc:50:04:b5:cf:f6:be:10:bf:c8:e8

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 17, 2026 - May 6, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

12609056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\WS\tv_prel_dcr\build_cmake_win64\QS\Release\TeamViewer_Desktop.pdb

dbghelp

SymFromAddr SymSetOptions SymGetOptions SymInitialize

ksuser

KsCreatePin

wevtapi

EvtCreateRenderContext EvtClose EvtRender EvtQuery EvtNext

kernel32

SetFileAttributesW CreateNamedPipeW TransactNamedPipe SetNamedPipeHandleState RemoveVectoredExceptionHandler GetVersion AddVectoredExceptionHandler Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection LoadLibraryExA GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA GetCommandLineW GetModuleFileNameW GetCurrentProcessId GetProcessShutdownParameters SetProcessShutdownParameters FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW LeaveCriticalSection EnterCriticalSection GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW InitializeCriticalSectionEx DeleteCriticalSection RaiseException GetCurrentThreadId DecodePointer TryAcquireSRWLockExclusive WaitForMultipleObjects WaitForSingleObject PostQueuedCompletionStatus FormatMessageW ReleaseSRWLockExclusive SetEvent AcquireSRWLockExclusive TerminateThread CloseHandle QueueUserAPC LocalFree WideCharToMultiByte FormatMessageA CreateEventA MoveFileExW GetTempPathW ExpandEnvironmentStringsW CreateDirectoryW CreateEventW GetUserGeoID GetGeoInfoW GetLocaleInfoW GlobalMemoryStatusEx GetComputerNameW DeleteFileW GetSystemTimeAsFileTime GetUserDefaultLCID LCMapStringA GetStringTypeExA LoadLibraryA SetLastError SetProcessAffinityMask GetCurrentProcess GetProcessAffinityMask GetSystemPowerStatus CancelIoEx GetStdHandle ReadFile HeapAlloc GetProcessHeap HeapFree VerSetConditionMask VerifyVersionInfoW QueryPerformanceCounter QueryPerformanceFrequency SetWaitableTimer GetQueuedCompletionStatus SleepEx CreateIoCompletionPort InitializeSRWLock CreateWaitableTimerW GetTickCount GetSystemDefaultUILanguage GetUserDefaultUILanguage LCIDToLocaleName SetThreadExecutionState HeapSize HeapReAlloc WaitForSingleObjectEx DuplicateHandle CreateSemaphoreA ReleaseSemaphore SetUnhandledExceptionFilter FindFirstFileW FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FindClose LoadLibraryW CreateFileW CreateProcessW GetSystemDirectoryW WriteFile GetProcessHeaps K32GetProcessMemoryInfo K32GetPerformanceInfo GetProcessTimes GetSystemTime SystemTimeToFileTime GetProcessHandleCount OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW UnregisterWaitEx ProcessIdToSessionId WaitNamedPipeW ResumeThread TerminateProcess QueryFullProcessImageNameW K32EnumProcesses RegisterWaitForSingleObject GetCurrentThread SetThreadPriority GetSystemTimes GetSystemInfo GetNativeSystemInfo GetLogicalProcessorInformationEx IsWow64Process SetSearchPathMode SetDllDirectoryW HeapSetInformation SetProcessDEPPolicy GetFileAttributesW GetPrivateProfileStringW InitializeCriticalSection InitOnceExecuteOnce RemoveDirectoryW GetTickCount64 GetThreadId VirtualQuery Module32FirstW Module32NextW InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS CreateThread LCMapStringW GetStringTypeExW LockResource GetPriorityClass SetPriorityClass GetExitCodeThread DeviceIoControl ResetEvent Sleep GetEnvironmentStringsW FreeEnvironmentStringsW GetLocaleInfoEx GlobalSize GlobalLock GlobalUnlock GetSystemDefaultLCID GlobalAlloc GlobalFree IsDebuggerPresent LocalAlloc CreateSemaphoreW SleepConditionVariableSRW WakeAllConditionVariable DebugBreak GetPrivateProfileIntW GetPrivateProfileSectionW WritePrivateProfileStringW SwitchToThread UnmapViewOfFile CreateFileMappingA OpenFileMappingA MapViewOfFileEx OpenEventW WTSGetActiveConsoleSessionId GetFullPathNameW GetEnvironmentVariableA GetFileSizeEx GetCurrentDirectoryW SetFilePointerEx ReleaseMutex CreateMutexW OpenMutexW GetFileSize GetDynamicTimeZoneInformation GetTimeZoneInformation GetTimeFormatW GetDateFormatW GetLocalTime GetActiveProcessorCount GetActiveProcessorGroupCount GetCurrentProcessorNumberEx SetThreadGroupAffinity WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetStdHandle HeapQueryInformation EnumSystemLocalesW IsValidLocale CompareStringW FlsFree FlsSetValue VirtualProtect OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache VirtualAlloc VirtualFree InitOnceBeginInitialize InitOnceComplete GetStringTypeW RtlPcToFileHeader ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockShared FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx LCMapStringEx CompareStringEx GetCPInfo GetEnvironmentVariableW FlushFileBuffers GetFileTime SetEndOfFile GetWindowsDirectoryW CopyFileExW WaitForMultipleObjectsEx OpenEventA TlsAlloc TlsGetValue TlsSetValue TlsFree CreateWaitableTimerA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwindEx RtlUnwind InitializeCriticalSectionAndSpinCount ExitThread FreeLibraryAndExitThread GetModuleHandleExW SetConsoleCtrlHandler GetFileType LockFileEx UnlockFileEx GetDriveTypeW PeekNamedPipe ExitProcess SetEnvironmentVariableW GetConsoleMode ReadConsoleW GetConsoleOutputCP FlsAlloc FlsGetValue

magnification

MagInitialize MagUninitialize MagSetWindowTransform MagSetColorEffect MagSetWindowFilterList MagSetImageScalingCallback MagSetWindowSource

d2d1

ord1

rpcrt4

NdrClientCall2

Name

.text

Size

12.9MB

Virtual Size

12.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

IPPCODE

Size

275KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

389KB

Virtual Size

492KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

474KB

Virtual Size

474KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

IPPDATA

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_3f0dd224525dbe75d662a75c72c5f55c_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

dbghelp

ksuser

wevtapi

kernel32

magnification

d2d1

rpcrt4

generic