2026-08-05_d9eb5cba217c2ec4d6335243d6dadddc_blankgrabber_glassworm_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_d9eb5cba217c2ec4d6335243d6dadddc_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 67.6MB
Sample260805-lsfessvanf
SHA256 92539d8fa751a5c280725b00cc56b5b6da1fb8f9c8695b3e1a803f74faf6c866
MD5 d9eb5cba217c2ec4d6335243d6dadddc
SHA1 4764bf4068446997f3ecf51586a4602c8df3649d
SHA512 ef809d9a29f8139af640ff8767f4061f5d7fe78bbad35f8f6da3a31c37803aad7b0b16194cd5d9e9e3e68140215248db8e3a925b5db1b5343602b67a53b2beb2
SSDEEP 786432:97k9ljbmaV1B0XyR/NPRHq0IokDS7TsV7qRK4FEEKm9:9GmafBx/PHqfXucV7qRKaKm9
TLSH
T1E4F7BFD610DADD4AC7364836AAC816D78159EC785F20A123DC3EDF134BE2BE403659AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

themida

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_d9eb5cba217c2ec4d6335243d6dadddc_blankgrabber_glassworm_icedid_luca-stealer_njrat

File Explorer

2026-08-05_d9eb5cba217c2ec4d6335243d6dadddc_blankgrabber_glassworm_icedid_luca-stealer_njrat

.exe 67.6MB

2026-08-05_d9eb5cba217c2ec4d6335243d6dadddc_blankgrabber_glassworm_icedid_luca-stealer_njrat

SHA256 92539d8fa751a5c280725b00cc56b5b6da1fb8f9c8695b3e1a803f74faf6c866
MD5 d9eb5cba217c2ec4d6335243d6dadddc
SHA1 4764bf4068446997f3ecf51586a4602c8df3649d
SHA512 ef809d9a29f8139af640ff8767f4061f5d7fe78bbad35f8f6da3a31c37803aad7b0b16194cd5d9e9e3e68140215248db8e3a925b5db1b5343602b67a53b2beb2
SSDEEP 786432:97k9ljbmaV1B0XyR/NPRHq0IokDS7TsV7qRK4FEEKm9:9GmafBx/PHqfXucV7qRKaKm9
TLSH
T1E4F7BFD610DADD4AC7364836AAC816D78159EC785F20A123DC3EDF134BE2BE403659AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with Themida
Detects executables referencing many IR and analysis tools
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64652810

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

769KB

Virtual Size

769KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

172KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7.9MB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

58.8MB

Virtual Size

58.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_d9eb5cba217c2ec4d6335243d6dadddc_blankgrabber_glassworm_icedid_luca-stealer_njrat

generic