2026-08-10_1bdb67549d278ad77237fb5bec66a1b6_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_1bdb67549d278ad77237fb5bec66a1b6_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc
Size 2.9MB
Sample260810-fy28vswwft
SHA256 1ee04713c876ef559e3fa3b706a86f65374db3477e088be0f5b6630538839f66
MD5 1bdb67549d278ad77237fb5bec66a1b6
SHA1 edb3132cc251661cc6b62894dd9de98d945fe974
SHA512 bd9b3b8185428ac07c89916952c1d933022de5b52aa2a4357b24fc18eb6ebd48ee161e960139f3a4f3a9ddacbc5d2526f2b37f4ca938af836f5994b0c662e2b1
SSDEEP 49152:ucA7rGeIekTU/JgPRQDwxlcZM6cN1V7GXu8I0XC0d/0nlfnVp4+QP6MoGVXAhLpB:mdgCJgP5aM6cN1V7GXuSsW65CO2m
TLSH
T150E5D057A2A401F8D0B7D178CA47960BE67274091370AAEF13E08AA91F637E15F7F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_1bdb67549d278ad77237fb5bec66a1b6_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-10_1bdb67549d278ad77237fb5bec66a1b6_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

.exe 2.9MB

2026-08-10_1bdb67549d278ad77237fb5bec66a1b6_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH a0cfdea69a7c24b8b4308f1108e3f20c
SHA256 1ee04713c876ef559e3fa3b706a86f65374db3477e088be0f5b6630538839f66
MD5 1bdb67549d278ad77237fb5bec66a1b6
SHA1 edb3132cc251661cc6b62894dd9de98d945fe974
SHA512 bd9b3b8185428ac07c89916952c1d933022de5b52aa2a4357b24fc18eb6ebd48ee161e960139f3a4f3a9ddacbc5d2526f2b37f4ca938af836f5994b0c662e2b1
SSDEEP 49152:ucA7rGeIekTU/JgPRQDwxlcZM6cN1V7GXu8I0XC0d/0nlfnVp4+QP6MoGVXAhLpB:mdgCJgP5aM6cN1V7GXuSsW65CO2m
TLSH
T150E5D057A2A401F8D0B7D178CA47960BE67274091370AAEF13E08AA91F637E15F7F712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1395904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

shell32

ShellExecuteA ShellExecuteW

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSendRequest WinHttpOpenRequest WinHttpQueryDataAvailable

crypt32

CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertGetNameStringW CertFindCertificateInStore CryptProtectData CryptUnprotectData CertFreeCertificateChain CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFindExtension CertFreeCertificateContext

bcrypt

BCryptGenerateSymmetricKey BCryptGetProperty BCryptSetProperty BCryptDecrypt BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptVerifySignature BCryptGenRandom BCryptImportKeyPair BCryptDestroyKey BCryptDestroyHash

ole32

CoCreateInstance CoInitializeEx CreateStreamOnHGlobal CoCreateFreeThreadedMarshaler CoUninitialize

api-ms-win-core-file-l1-1-0

SetEndOfFile GetFileAttributesExW FlushFileBuffers SetFilePointerEx GetDriveTypeW GetFileSizeEx RemoveDirectoryW DeleteFileW SetFileInformationByHandle GetFullPathNameW WriteFile GetFileInformationByHandle FindNextFileW CreateFileW FindFirstFileExW FindFirstFileW FindClose GetFileAttributesA GetFileAttributesW ReadFile CreateDirectoryW GetVolumeInformationW

api-ms-win-core-memory-l1-1-0

VirtualFreeEx VirtualQuery WriteProcessMemory CreateFileMappingW VirtualAllocEx VirtualProtect VirtualAlloc UnmapViewOfFile ReadProcessMemory MapViewOfFile

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW LoadResource SizeofResource GetModuleHandleExW GetModuleHandleW FreeLibrary GetProcAddress FreeLibraryAndExitThread GetModuleHandleA GetModuleFileNameW LockResource GetModuleFileNameA SetDefaultDllDirectories AddDllDirectory

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-handle-l1-1-0

DuplicateHandle CloseHandle

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot Process32FirstW Process32NextW

api-ms-win-core-synch-l1-2-0

WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW Sleep

api-ms-win-core-processthreads-l1-1-0

GetExitCodeProcess ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TerminateProcess GetCurrentThread CreateRemoteThread GetStartupInfoW CreateProcessW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId TlsAlloc OpenProcessToken GetExitCodeThread ExitProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetTickCount64 GetSystemTimeAsFileTime GetSystemTime GetWindowsDirectoryW GetSystemDirectoryW

api-ms-win-core-errorhandling-l1-1-0

GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter RaiseException

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentVariableW SetStdHandle GetEnvironmentStringsW GetCommandLineA GetCommandLineW GetCurrentDirectoryW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-synch-l1-1-0

TryAcquireSRWLockExclusive WaitForSingleObject CreateEventW SetEvent InitializeCriticalSectionAndSpinCount

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-heap-l2-1-0

LocalFree GlobalFree GlobalAlloc

api-ms-win-core-file-l2-1-0

MoveFileExW GetFileInformationByHandleEx

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-psapi-l1-1-0

K32GetModuleInformation QueryFullProcessImageNameW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW LoadLibraryA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar GetStringTypeW CompareStringEx CompareStringW

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-localization-l1-2-0

GetLocaleInfoA LCMapStringEx FormatMessageA IsValidCodePage GetACP GetOEMCP GetCPInfo EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetLocaleInfoEx

d3dcompiler_47

D3DCompile

api-ms-win-core-kernel32-legacy-l1-1-1

SetDllDirectoryW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyA

ws2_32

getsockopt ntohl getaddrinfo freeaddrinfo inet_pton send inet_ntop WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs WSASetLastError gethostname ioctlsocket sendto recvfrom listen WSAStartup htonl WSACleanup WSACreateEvent accept select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect bind WSACloseEvent

dnsapi

DnsQuery_A DnsFree

wintrust

WinVerifyTrust

api-ms-win-security-sddl-ansi-l1-1-0

ConvertSidToStringSidA

advapi32

CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptAcquireContextW CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash SystemFunction036

kernel32

GetFileType InitializeCriticalSection LeaveCriticalSection Module32NextW Module32FirstW GetSystemInfo SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx DeleteCriticalSection PeekNamedPipe LoadLibraryW SleepEx WaitForSingleObjectEx K32EnumProcessModules GetStdHandle WaitForMultipleObjects VerifyVersionInfoW EnterCriticalSection GetEnvironmentVariableA

user32

UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow DefWindowProcW PeekMessageW DispatchMessageW ShowWindow SetWindowPos BringWindowToTop SetFocus GetAsyncKeyState UpdateWindow SetForegroundWindow GetClientRect LoadIconW PostQuitMessage TranslateMessage SendMessageW MessageBoxA ReleaseCapture LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetForegroundWindow IsWindowUnicode SetCapture GetCapture OpenClipboard CloseClipboard SetClipboardData GetClipboardData GetKeyboardLayout GetKeyState EmptyClipboard TrackMouseEvent GetMessageExtraInfo

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

shlwapi

PathFindFileNameW

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader RtlUnwind RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlUnwindEx

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InitializeSListHead

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation FileTimeToSystemTime SystemTimeToTzSpecificLocalTime

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP WriteConsoleW GetConsoleMode ReadConsoleW

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapSize HeapAlloc HeapFree HeapReAlloc

api-ms-win-core-fibers-l1-1-0

FlsGetValue FlsSetValue FlsFree FlsAlloc

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

api-ms-win-core-namedpipe-l1-1-0

CreatePipe

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

537KB

Virtual Size

537KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

766KB

Virtual Size

765KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_1bdb67549d278ad77237fb5bec66a1b6_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

d3d11

shell32

winhttp

crypt32

bcrypt

ole32

api-ms-win-core-file-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-localization-l1-2-0

d3dcompiler_47

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-registry-l2-1-0

ws2_32

dnsapi

wintrust

api-ms-win-security-sddl-ansi-l1-1-0

advapi32

kernel32

user32

imm32

shlwapi

api-ms-win-core-file-l1-2-2

api-ms-win-core-util-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

oleaut32

generic