2026-08-09_10ea785f885fdfa3a01517ff9d0141f1_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_10ea785f885fdfa3a01517ff9d0141f1_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc
Size 3.5MB
Sample260809-dwyrjszaje
SHA256 8b853ef277cb73560199bf6081a8d1bad57ed077028f9ab0c3df4860d1f1afeb
MD5 10ea785f885fdfa3a01517ff9d0141f1
SHA1 2bb0d5e1b859c6257365a80231581b7718bf3c62
SHA512 d186108635b5af0bb94635be1cb233f96ec94bef8faa2dbdb27ad1be44ede77e02611e91d4fcfd5e99bcf1eea9a30fda8229fd855fb7493047b26de83424e9d7
SSDEEP 98304:V7AnkrLP7+uRYd8Qsjg/Z6YmFHBc7KntG:V7Ikrf+0Yd8Qsjg/Z61F+GntG
TLSH
T1ACF5D04AA3A600EAC1A7C138C756971BE7B230060731ABDF16E54A652F23EE15F7F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_10ea785f885fdfa3a01517ff9d0141f1_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-09_10ea785f885fdfa3a01517ff9d0141f1_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

.exe 3.5MB

2026-08-09_10ea785f885fdfa3a01517ff9d0141f1_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 603d5db243e00d39a45a7e0f53ddf138
SHA256 8b853ef277cb73560199bf6081a8d1bad57ed077028f9ab0c3df4860d1f1afeb
MD5 10ea785f885fdfa3a01517ff9d0141f1
SHA1 2bb0d5e1b859c6257365a80231581b7718bf3c62
SHA512 d186108635b5af0bb94635be1cb233f96ec94bef8faa2dbdb27ad1be44ede77e02611e91d4fcfd5e99bcf1eea9a30fda8229fd855fb7493047b26de83424e9d7
SSDEEP 98304:V7AnkrLP7+uRYd8Qsjg/Z6YmFHBc7KntG:V7Ikrf+0Yd8Qsjg/Z61F+GntG
TLSH
T1ACF5D04AA3A600EAC1A7C138C756971BE7B230060731ABDF16E54A652F23EE15F7F711
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1473392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Leon\Downloads\auth 2.1\atlas\x64\Release\Atlas.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoUninitialize CoInitializeEx CoCreateInstance

winhttp

WinHttpOpen WinHttpReceiveResponse WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts

crypt32

CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

ws2_32

recvfrom listen htonl accept select sendto WSAIoctl ioctlsocket setsockopt recv htons getsockname getpeername __WSAFDIsSet bind gethostname WSAStartup WSASetLastError ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt ntohl inet_pton getaddrinfo inet_ntop freeaddrinfo connect socket WSACleanup

advapi32

GetTokenInformation AddAccessAllowedAce GetLengthSid SetSecurityInfo InitializeAcl OpenProcessToken IsValidSid RegCreateKeyExA RegDeleteKeyA ConvertSidToStringSidW CopySid SystemFunction036 CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptImportKey CryptEncrypt CryptDestroyKey

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsQuery_A DnsFree

kernel32

ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind RtlUnwindEx OutputDebugStringW ExitThread FreeLibraryAndExitThread DuplicateHandle CreateProcessW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetFilePointerEx GetCommandLineA GetCommandLineW GetConsoleMode ReadConsoleW GetConsoleOutputCP FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW GetLocaleInfoEx GetStringTypeW GetCPInfo LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetTimeZoneInformation DeleteFileW WaitForSingleObject GetExitCodeProcess CreatePipe GetModuleHandleA GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte SetStdHandle GetModuleFileNameA WriteFile GetTempPathA CreateFileA DeleteFileA CloseHandle LoadLibraryW GetModuleHandleW CreateProcessA GetTickCount GetLastError VirtualProtect HeapFree SetDefaultDllDirectories AddDllDirectory GetCurrentProcess GetModuleFileNameW InitializeCriticalSectionEx CreateFileW GetCurrentThreadId GetSystemDirectoryW UnmapViewOfFile HeapSize Sleep GetTickCount64 HeapReAlloc CreateThread HeapAlloc DecodePointer AddVectoredExceptionHandler HeapDestroy DeleteCriticalSection GetCurrentProcessId GetProcessHeap QueryFullProcessImageNameW CreateFileMappingW MapViewOfFile SetDllDirectoryW VirtualQuery LocalFree InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemInfo VirtualAlloc ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageW SleepEx MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns RaiseException RtlPcToFileHeader TryAcquireSRWLockExclusive FormatMessageA InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsDebuggerPresent CompareStringEx SetEndOfFile IsValidCodePage GetACP GetOEMCP IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GlobalUnlock WriteConsoleW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW LCMapStringEx EncodePointer WakeAllConditionVariable

user32

CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW SetWindowLongA PeekMessageW MessageBoxA MoveWindow SetLayeredWindowAttributes TranslateMessage PostQuitMessage UpdateWindow OpenClipboard DestroyWindow EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos GetWindowRect DefWindowProcW GetWindowLongW CloseClipboard

shell32

ShellExecuteW ShellExecuteExA

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

wininet

InternetOpenUrlA InternetOpenA HttpQueryInfoA InternetReadFile InternetCloseHandle

shlwapi

ord12 PathFileExistsA PathFindFileNameW

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_10ea785f885fdfa3a01517ff9d0141f1_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

d3d11

d3dcompiler_47

ole32

winhttp

crypt32

ws2_32

advapi32

psapi

wintrust

dnsapi

kernel32

user32

shell32

dwmapi

imm32

wininet

shlwapi

userenv

bcrypt

generic