pysilon | 2026-08-09_37dd46093a4d63498fc5adf213b75a64_blankgrabber_glassworm_icedid_luca-stealer_njrat

resource	yara_rule
static1/unpack001/source_prepared.pyc	pysilon

resource	yara_rule
sample	pyinstaller

resource
2026-08-09_37dd46093a4d63498fc5adf213b75a64_blankgrabber_glassworm_icedid_luca-stealer_njrat

2026-08-09_37dd46093a4d63498fc5adf213b75a64_blankgrabber_glassworm_icedid_luca-stealer_njrat

IMPHASH dcaf48c1f10b0efa0a4472200f3850ed
SHA256 3067b2f4e29e11a0885a2f53ea01246cbfd95a0594ed7fb9b61bf8967ad74e24
MD5 37dd46093a4d63498fc5adf213b75a64
SHA1 0227e2fecc01fd7689bd9bc96d45192867d51a7a
SHA512 f05e7c569a86ac45b793fd80ece1a9c64707493dee4f11ed767ef3b618873dfb4a7950754b29172526ac325ede0ff1610b63c6916216c093948fbfb366fe2e81
SSDEEP 1572864:ioMo80EWxlXJbWcMOkiqOv8im2A3+TqRCt2VliR1Fp2mjIkIOHNsj:id30EWxRpyOknOv8i36+TqjVwRhckJHM
TLSH
T14E1833A6918989E1CCF4307159E9D509E467EAEA8F10C68797B85630BEE70DFEC30F11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

55856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CreateWindowExW ShutdownBlockReasonCreate MsgWaitForMultipleObjects ShowWindow DestroyWindow RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage PostMessageW GetMessageW MessageBoxW MessageBoxA SystemParametersInfoW DestroyIcon SetWindowLongPtrW GetWindowLongPtrW GetClientRect InvalidateRect ReleaseDC GetDC DrawTextW GetDialogBaseUnits EndDialog DialogBoxIndirectParamW MoveWindow SendMessageW

comctl32

ord380

kernel32

GetACP IsValidCodePage GetStringTypeW GetFileAttributesExW SetEnvironmentVariableW FlushFileBuffers LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx GetOEMCP GetCPInfo GetLastError FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleW MulDiv FormatMessageW GetModuleFileNameW SetDllDirectoryW GetEnvironmentStringsW SetErrorMode CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDriveTypeW RemoveDirectoryW GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW LocalFree SetConsoleCtrlHandler K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte FlsFree FreeEnvironmentStringsW GetProcessHeap GetTimeZoneInformation HeapSize HeapReAlloc WriteConsoleW SetEndOfFile CreateSymbolicLinkW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc GetCurrentDirectoryW FlsAlloc FlsGetValue FlsSetValue

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

gdi32

SelectObject DeleteObject CreateFontIndirectW

Name

.text

Size

175KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

discord_token_grabber.pyc

SHA256 7a2d13f14b66c3f4f44810b17c9126bc05c377c1d1fd83f3b83430a1ce2cb778
MD5 a564f1e92fb23d1e7ec4ec31cdf98e39
SHA1 77197cec502e79c0805652ca2062c7bcf683aa7f
SHA512 5fffa387edc945b1d6a5663fb93326cb55494794896accb7d5e656a6b91971628efcc25dea881473730a75ed1a5e7e309f9b622c29338d064ea2b8c620f9831d
SSDEEP 384:cGmlyAavwS9F0RW807PPQviowoYbCj+Mo8WWIc02a8:c7lytvX9iRW8inQ6owoYOyM0d2a8
TLSH
T13782EB6169D6D93FFA88F3B8984B3A0EFBB446E4F145835719A6A012FD473207D104EE
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

get_cookies.pyc

SHA256 f4bc00c8957415a6162f18eace6ace34a33eb35c233a9696f1551d0c1699980c
MD5 f68d47ab00cf20dc10b98ace83b5fa8b
SHA1 8ec21c16500c8801bea4ed82106a7456a0296244
SHA512 66d6a6dda0da8c293e6b08f1452e3ede8395adcf565fccebe048cacec0612c27d435a9d26caa4f2ba42ffb6fe25fa07fe1e24cac9260f833087685e5dfe34b83
SSDEEP 192:Tz1CIeinQfUF9LdwOEVOFc1mNe47+o+zEzzzzz1zz+HoowAE:Tz1UiQccEe4KoOIAE
TLSH
T17C22A2496B5EE07EFD54F7B48802460DB7A4C4E0A280C3936B6BC8359E5BB44BD254EE
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

misc.pyc

SHA256 a1ea47c674bdbe7d82a1e7cc0c66f9712ad278bb84dd414cf65b69f0ba5df34e
MD5 1477b680b8aae35bf7b4ea0add304490
SHA1 9fb9bad236a27312f133db010103336a639f53c8
SHA512 63fca06346dabf2d2c3890c35b85ee4423454ac21bb161c569459f092da8145b1651baca779e1196878845ef8571747d9bb80e4ef80e845e8655f6e233d63bfd
SSDEEP 96:DSajAih1JG4n3B4SmSSSSlSSSShDwegPbbVxlj0nIAEDS5ejmw01k9Bddpq:eYrfn3ySmSSSSlSSSSeeOPVxx0nIAZeQ
TLSH
T15BB1C48375439CBEF8E5A2B45187080273A0C6F0F2B5C3177655B926EFDAE601D210ED
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

passwords_grabber.pyc

SHA256 abe4bf75171f4f519eeb58cb0fe56216e55af10109f5a8be54893cf71c30df06
MD5 dcb5d7fcb8bdb8992cf2087e9a6d496e
SHA1 edfc5fd652b09fdbb33ce9c05f16e08d22b2dbfc
SHA512 3945f3f8be7086f429481330fb5dbe3e98e563011183009c1b42a9cfce1c0d8478e06bc20079ac02494165b25ebbea8a1dddb79558e6c75c7b4e3b96c276f3ed
SSDEEP 192:+CE35EAL/GFf/PomdPO23NsDmqFUhkxNivLI9dRvL:Y5EAL/AfRBO8NsxuOxNn
TLSH
T1920272863E63D87BF814F3F55062220D73A485F5B340CB132AABD16E9E1B6E91E148DD
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Pyinstaller

pyinstaller

source_prepared.pyc

SHA256 40e177074ea882a764e86669b03143eb032d68773e0eb1f37eeafd92af35a51a
MD5 e1ff5e38bc27455e7a2889a9cce3d447
SHA1 eb208af57e885e28b24ea8558d2805e90dbeb6e6
SHA512 50d8e3a21f18d55d25e09ca05bb820e3a10bdc29cf3128f459e31a30ce6c4cc1ecd653ce0399943f688a1e2c7f9cf8f4102dbe85213db4d7dc3daf3fcc87f0da
SSDEEP 3072:wTPLaxIuA9MVdSmoJPEtelZN+tVZa2EngglQ0WCkn0:wTPWxI37moJ8cN+7Za2EnggSHCh
TLSH
T18404B44177A6D6BFF8466776C856270B7BA4C4F1F310CB1B2BB7A021AD85B202C461ED
MD5 SHA1 SHA512 SSDEEP TLSH

Detect Pysilon
Detects Pyinstaller

pyinstaller

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_37dd46093a4d63498fc5adf213b75a64_blankgrabber_glassworm_icedid_luca-stealer_njrat

user32

comctl32

kernel32

advapi32

gdi32

generic

discord_token_grabber.pyc

get_cookies.pyc

misc.pyc

passwords_grabber.pyc

source_prepared.pyc