2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc
Size 9.5MB
Sample260809-ch6dsssse1
SHA256 f6ba97bdea91db767622a98c96fd3432f1ca0fefae132312f4f8c7095408623a
MD5 97518d632963ea7cc4ea67337b0e688b
SHA1 208ca5b4d9a2cf43f9e71614d92a86821c99bcfb
SHA512 ed0d13b90880c70aa399d0da02a78c6640f690a32771fc8e9bf1ae884076e515759ef07633ac33c43fc870e40dc47764864762afbec5e026c979bb2bbf89a759
SSDEEP 98304:2kJJPu6KZ6o1sw5H4BftoasojQcx91XyO6Yujw+B8z:2kJRc6isw5H4BftoasojQcx91XH6b0z
TLSH
T18EA68C56E37800E8D4AAC2B8C7465157D771744A03B0ABDF1A90AEA12F37AE51F3F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc

File Explorer

2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc

.exe 9.5MB

2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc

IMPHASH 422b43e0ae1dca90c3dad77e53881d84
SHA256 f6ba97bdea91db767622a98c96fd3432f1ca0fefae132312f4f8c7095408623a
MD5 97518d632963ea7cc4ea67337b0e688b
SHA1 208ca5b4d9a2cf43f9e71614d92a86821c99bcfb
SHA512 ed0d13b90880c70aa399d0da02a78c6640f690a32771fc8e9bf1ae884076e515759ef07633ac33c43fc870e40dc47764864762afbec5e026c979bb2bbf89a759
SSDEEP 98304:2kJJPu6KZ6o1sw5H4BftoasojQcx91XyO6Yujw+B8z:2kJRc6isw5H4BftoasojQcx91XH6b0z
TLSH
T18EA68C56E37800E8D4AAC2B8C7465157D771744A03B0ABDF1A90AEA12F37AE51F3F712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

28:c9:28:09:23:3e:28:56:b9:2f:e9:12:e9:b2:3b:ac:9d:68:ef:70:5f:b2:a5:76:d5:ba:7a:d0:48:dd:58:b2

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 8, 2025

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:a8:82:e6:b8:ac:1c:5d:5f:f0:00:00:00:00:04:a8

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 12, 2024 - Sep 11, 2025

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:07:2c:11:39:89:cd:85:fb:c5:00:01:00:00:02:07

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

7045620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptGenRandom BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGetProperty BCryptDestroyKey

advapi32

CryptSignHashW RegOpenKeyExW CryptEncrypt CryptImportKey CryptHashData CryptGetHashParam CryptEnumProvidersW RegQueryValueExW CryptDestroyHash GetTokenInformation RegOpenKeyExA OpenProcessToken RegSetValueExA GetUserNameA RegCreateKeyExA RegQueryValueExA RegCloseKey RegDeleteTreeA RegEnumKeyExA RegEnumValueA RegQueryInfoKeyA CredFree CredEnumerateA DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptGenRandom CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFreeCertificateChain PFXImportCertStore CryptUnprotectData CryptStringToBinaryA CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW CryptStringToBinaryW CertFindExtension CryptDecodeObjectEx CertFreeCRLContext CertAddCertificateContextToStore CertFreeCTLContext

secur32

InitSecurityInterfaceW

ws2_32

freeaddrinfo getaddrinfo __WSAFDIsSet WSAIoctl WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent sendto recvfrom getpeername shutdown socket setsockopt listen connect closesocket bind accept getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr htons htonl WSACleanup WSAStartup gethostbyname select ntohs getsockopt getsockname ioctlsocket WSAGetLastError WSASetLastError send recv inet_ntop gethostname

shell32

SHGetFolderPathA DragQueryFileW ShellExecuteA ShellExecuteExA

user32

SetWindowsHookExA GetWindowTextA MapVirtualKeyA GetForegroundWindow UnhookWindowsHookEx TranslateMessage ToUnicode PeekMessageA EmptyClipboard SetClipboardData EnumDisplayMonitors GetMonitorInfoA GetDC OpenClipboard CloseClipboard GetClipboardData GetAsyncKeyState ReleaseDC EnumDisplayDevicesA GetLastInputInfo DispatchMessageA CallNextHookEx GetKeyboardState MessageBoxW GetUserObjectInformationW DestroyWindow MonitorFromWindow GetSystemMetrics ShowWindow MessageBoxA SendMessageA FindWindowA GetCursorPos IsClipboardFormatAvailable GetProcessWindowStation

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader RtlVirtualUnwind VerSetConditionMask RtlUnwind

wlanapi

WlanCloseHandle WlanGetProfileList WlanEnumInterfaces WlanFreeMemory WlanOpenHandle WlanQueryInterface WlanGetProfile

ole32

CoUninitialize CoCreateInstance CoInitializeEx

gdi32

GetObjectA GetDeviceCaps BitBlt CreateCompatibleBitmap DeleteObject DeleteDC SelectObject CreateCompatibleDC GetDIBits

iphlpapi

GetAdaptersAddresses if_nametoindex GetAdaptersInfo

kernel32

GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeSListHead LoadLibraryExW TryAcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable GetLocaleInfoEx CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFileW DeviceIoControl SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle FindFirstFileExW CreateDirectoryW GetCurrentDirectoryW FlsGetValue FlsSetValue FlsFree RaiseException AreFileApisANSI HeapCreate HeapFree GetDiskFreeSpaceW LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW GetFileAttributesW HeapValidate HeapSize FormatMessageW GetDiskFreeSpaceA GetFileAttributesExW OutputDebugStringW FlushViewOfFile DeleteFileA DeleteFileW HeapReAlloc GetNativeSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile LockFileEx FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW InitializeCriticalSectionAndSpinCount ExitThread FreeLibraryAndExitThread SetEnvironmentVariableW SetConsoleCtrlHandler GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetConsoleOutputCP SetFilePointerEx WriteConsoleW GetFileSize GetSystemFirmwareTable GetModuleFileNameA OpenEventA SizeofResource VirtualProtect GetCurrentProcess SetFileTime GetModuleFileNameW FindResourceA CreateMutexA WaitForSingleObject GetSystemDirectoryW UnmapViewOfFile GetModuleHandleA CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetTickCount64 GetLastError GetFileAttributesA Process32NextW CreateFileA GetCurrentThread GetSystemDirectoryA LoadLibraryA LockResource QueryPerformanceFrequency Process32FirstW CloseHandle GetSystemInfo GetWindowsDirectoryA LoadResource AddVectoredExceptionHandler GetThreadContext GetProcAddress CreateFileMappingA GetProcessHeap ExitProcess GlobalMemoryStatusEx CreateProcessW FreeLibrary WideCharToMultiByte GetConsoleWindow CreateProcessA GetDiskFreeSpaceExA MapViewOfFile QueryPerformanceCounter GetTickCount GetFileTime IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent GetEnvironmentVariableA OpenProcess K32GetModuleFileNameExA OutputDebugStringA TerminateProcess GetExitCodeProcess GlobalLock GlobalUnlock GetLogicalDrives GetDriveTypeA GetUserDefaultLocaleName GetLocaleInfoA GetTimeZoneInformation QueryFullProcessImageNameA ReadFile WriteFile GlobalAlloc Process32First Process32Next ExpandEnvironmentStringsA LocalFree GetCurrentProcessId GetStdHandle GetFileType GetModuleHandleW SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree FormatMessageA GetModuleHandleExW GetSystemTimeAsFileTime VirtualFree GetEnvironmentVariableW GetACP InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetSystemTime SystemTimeToFileTime LoadLibraryW FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW CreateFileW GetFullPathNameW MoveFileExW InitializeCriticalSectionEx SleepEx WaitForSingleObjectEx CreateThread PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx FlushFileBuffers CreateFileMappingW FlsAlloc

Name

.text

Size

7.1MB

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

53KB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

264KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc

PE Signature issue

bcrypt

advapi32

crypt32

secur32

ws2_32

shell32

user32

ntdll

wlanapi

ole32

gdi32

iphlpapi

kernel32

generic