2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk
Size 2.0MB
Sample260809-3v1l7axeqa
SHA256 d8d69a0bfb1bf350324f67e558b958b0e921cb296adbabf5e16a6a30f1300b57
MD5 92e4e622cdbc87172983acd7bd6ff90a
SHA1 bbfee061a3e66b6464baadd956ecf8d9aed4b659
SHA512 53ccfa1efba78f0e55ed70caacc24f16983bb26ca0062bb176eb731bed03df7243e49a610352b7e17c3a4f88e8ec04c91a79d36a21f0172f69845b0af382b3e5
SSDEEP 49152:05Qc3U7rZNnOT6Q3Umy2emp2AQgAT76sQuE:Z9QpqGsQr
TLSH
T13FA58D2AE7EC41E9D0F6C27589B39547E7B278194F32C75F0A615A1E1F3B6A08D38321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk

File Explorer

2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk

.exe 2.0MB

2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk

IMPHASH c820d00284527952e930c15ba6fb69f0
SHA256 d8d69a0bfb1bf350324f67e558b958b0e921cb296adbabf5e16a6a30f1300b57
MD5 92e4e622cdbc87172983acd7bd6ff90a
SHA1 bbfee061a3e66b6464baadd956ecf8d9aed4b659
SHA512 53ccfa1efba78f0e55ed70caacc24f16983bb26ca0062bb176eb731bed03df7243e49a610352b7e17c3a4f88e8ec04c91a79d36a21f0172f69845b0af382b3e5
SSDEEP 49152:05Qc3U7rZNnOT6Q3Umy2emp2AQgAT76sQuE:Z9QpqGsQr
TLSH
T13FA58D2AE7EC41E9D0F6C27589B39547E7B278194F32C75F0A615A1E1F3B6A08D38321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

727180

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f:\jnks\workspace\K24_CXP_Production_Build\build2787\SxS\src\x64\Release\HPNetworkCommunicatorCom.pdb

kernel32

CloseHandle CreateEventW WaitForSingleObject GetCurrentThreadId CreateThread Sleep SetEvent TryEnterCriticalSection InitializeCriticalSection DecodePointer MultiByteToWideChar FindResourceW GetModuleHandleW GetModuleFileNameW LoadLibraryExW lstrcmpiW SizeofResource LoadResource DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetFileSize CancelIo GetOverlappedResult GetCommandLineW GetFullPathNameW GetLastError RaiseException GetProcAddress WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW SetFilePointerEx FlushFileBuffers GetProcessHeap SetStdHandle GetFileType EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW HeapSize GetConsoleCP ReadConsoleW GetConsoleMode ReadFile GetACP GetStdHandle ExitProcess HeapFree HeapReAlloc HeapAlloc GetTimeZoneInformation GetModuleHandleExW RemoveDirectoryW FreeLibraryAndExitThread ExitThread VirtualQuery VirtualProtect SetLastError QueryPerformanceCounter ExpandEnvironmentStringsW GetCurrentProcessId GetTickCount CreateFileW SetFilePointer WriteFile OutputDebugStringW OpenProcess GetFileAttributesExW GetTempFileNameW GetLongPathNameW SearchPathW FormatMessageW LocalFree CreateMutexW CreateFileMappingW MapViewOfFile ReleaseMutex UnmapViewOfFile LoadLibraryW QueryPerformanceFrequency LockResource GlobalAlloc GlobalLock GlobalUnlock GlobalFree GlobalMemoryStatusEx LocalAlloc GetShortPathNameW GetCurrentProcess GetExitCodeProcess TerminateThread GetExitCodeThread ResetEvent WaitForMultipleObjects GetFileSizeEx DeviceIoControl FindClose GetFileTime GetSystemTime GetLocalTime CreatePipe ConnectNamedPipe DisconnectNamedPipe PeekNamedPipe FlushViewOfFile OpenMutexW OpenEventW OpenFileMappingW CreateProcessW GetStartupInfoW GetEnvironmentVariableW FindResourceExW GetSystemDirectoryW GetTempPathW SetCurrentDirectoryW GetCurrentDirectoryW GetDiskFreeSpaceExW CreateDirectoryW SetFileAttributesW GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileExW CreateNamedPipeW WaitNamedPipeW GetComputerNameExW GetVersionExW VerifyVersionInfoW ProcessIdToSessionId WideCharToMultiByte GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetUserDefaultLangID GetSystemDefaultLCID GetUserDefaultLCID GetPrivateProfileStringW GetPrivateProfileStringA WritePrivateProfileStringW WritePrivateProfileStringA lstrcpyW lstrcatW GetSystemDirectoryA LoadLibraryA FormatMessageA IsDebuggerPresent GetStringTypeW EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetCPInfo WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead RtlPcToFileHeader RtlUnwindEx GetSystemInfo VirtualAlloc FreeLibrary

user32

GetThreadDesktop SetThreadDesktop WaitForInputIdle GetAsyncKeyState MsgWaitForMultipleObjectsEx OpenWindowStationW CloseDesktop PeekMessageW CloseWindowStation SetProcessWindowStation GetProcessWindowStation RegisterWindowMessageW ExitWindowsEx SendMessageCallbackW GetKeyState MsgWaitForMultipleObjects SetTimer GetDesktopWindow SystemParametersInfoW DestroyIcon LoadIconW AllowSetForegroundWindow CharUpperW DispatchMessageW TranslateMessage GetMessageW PostThreadMessageW CharNextW GetSystemMetrics OpenDesktopW

advapi32

CryptDestroyHash RegQueryValueExW OpenProcessToken CheckTokenMembership GetUserNameW BackupEventLogW CloseEventLog OpenEventLogW AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl CreateProcessAsUserW ChangeServiceConfigW CloseServiceHandle ControlService OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatus StartServiceW SetEntriesInAclW RegEnumValueW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCloseKey RegCreateKeyExW

ole32

CLSIDFromString CoInitializeSecurity CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoInitializeEx CoUninitialize CoCreateInstance CoReleaseServerProcess CoAddRefServerProcess CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc PropVariantCopy CreateStreamOnHGlobal OleUninitialize OleInitialize CoCreateGuid CoSetProxyBlanket CoInitialize StringFromGUID2

oleaut32

SysFreeString SysStringLen VarUI4FromStr LoadTypeLi LoadRegTypeLi SysAllocString SysReAllocString SafeArrayCreate SafeArrayDestroy SafeArrayGetUBound SafeArrayGetLBound SafeArrayLock SafeArrayUnlock SafeArrayCopy SafeArrayGetVartype VariantInit VariantClear GetRecordInfoFromGuids RegisterTypeLi UnRegisterTypeLi SafeArrayRedim VariantCopy

shlwapi

PathIsFileSpecW PathFindExtensionW PathIsDirectoryW PathRemoveFileSpecW PathFindFileNameW

ws2_32

WSAStartup gethostbyaddr getservbyport WSASetLastError ioctlsocket WSAResetEvent WSACloseEvent WSACreateEvent WSADuplicateSocketW WSAEnumNetworkEvents WSASocketW WSAAddressToStringW WSAStringToAddressW freeaddrinfo ntohs WSAEventSelect setsockopt WSACleanup sendto getsockopt recv recvfrom connect socket send listen shutdown select closesocket bind accept __WSAFDIsSet inet_addr gethostbyname WSAGetLastError htons WSAWaitForMultipleEvents getservbyname htonl inet_ntoa getaddrinfo WSAConnect

rpcrt4

UuidToStringA RpcStringFreeA UuidCreate

iphlpapi

GetAdaptersAddresses GetIfEntry GetInterfaceInfo IcmpSendEcho IcmpCloseHandle IcmpCreateFile IpRenewAddress IpReleaseAddress GetAdaptersInfo DeleteIPAddress AddIPAddress NotifyAddrChange

psapi

EnumProcesses GetModuleBaseNameW GetModuleFileNameExW EnumProcessModules

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteExW ExtractIconW ShellExecuteW SHGetSpecialFolderPathW

wininet

InternetQueryOptionW InternetSetOptionW HttpSendRequestW HttpQueryInfoW HttpQueryInfoA InternetCloseHandle HttpOpenRequestW InternetConnectW InternetOpenW InternetReadFileExA HttpAddRequestHeadersW InternetErrorDlg

setupapi

SetupGetLineTextW SetupFindFirstLineW SetupCloseInfFile SetupDiSetClassInstallParamsW SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiOpenDeviceInfoW SetupDiEnumDeviceInfo CMP_WaitNoPendingInstallEvents SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiBuildDriverInfoList SetupDiGetSelectedDriverW CM_Set_DevNode_Registry_PropertyW CM_Locate_DevNodeW CM_Get_DevNode_Status CM_Get_DevNode_Registry_PropertyW CM_Get_Device_IDW CM_Disable_DevNode SetupOpenInfFileW SetupDiSetDeviceInstallParamsW SetupDiGetDeviceInstallParamsW SetupDiGetDeviceRegistryPropertyW SetupDiOpenDevRegKey SetupDiCreateDevRegKeyW SetupDiOpenClassRegKey SetupDiRemoveDevice SetupDiCallClassInstaller SetupDiGetClassDevsW SetupDiDestroyDriverInfoList SetupDiGetDriverInfoDetailW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

secur32

GetUserNameExW

winspool.drv

DocumentPropertiesW ord204 ord203 XcvDataW EnumPortsW DeleteMonitorW AddMonitorW EnumMonitorsW ClosePrinter FindClosePrinterChangeNotification FindNextPrinterChangeNotification FindFirstPrinterChangeNotification SetPrinterDataExW GetPrinterDataExW EndDocPrinter EndPagePrinter WritePrinter StartPagePrinter StartDocPrinterW EnumPrintersW OpenPrinterW SetJobW GetJobW EnumJobsW AddPrinterW DeletePrinter SetPrinterW GetPrinterW AddPrinterDriverW EnumPrinterDriversW GetPrinterDriverW GetPrinterDriverDirectoryW DeletePrinterDriverExW

crypt32

CertDeleteCertificateFromStore CryptUnprotectData CertCloseStore CertAddEncodedCertificateToStore CertOpenStore

Name

.text

Size

940KB

Virtual Size

940KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

499KB

Virtual Size

498KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=14, id=241, version=40116,

count=172, id=243, version=40116,

count=31, id=242, version=40116,

count=2, id=199, version=41118,

count=8, id=259, version=24123,

count=72, id=261, version=24123,

count=40, id=260, version=24123,

count=2, id=261, version=23013,

count=1, id=135, version=30729,

count=83, id=265, version=24213,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=480, id=1, productName=Unmarked objects,

count=1, id=260, productName=VS2015 UPD3 build 24213, version=24213,

count=20, id=261, productName=VS2015 UPD3 build 24213, version=24213,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3 build 24213, version=24213,