2026-08-13_593921f33d93d7090355c90fbd56e952_blankgrabber_gazer_glassworm_helldown_icedid_mespinoza_njrat_remcos_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_593921f33d93d7090355c90fbd56e952_blankgrabber_gazer_glassworm_helldown_icedid_mespinoza_njrat_remcos_ryuk_stealc
Size 6.3MB
Sample260813-qdd1msbb57
SHA256 008f5d53bbaf93c8a476191bac3c33a47918335701c1a036ef048000a44d610f
MD5 593921f33d93d7090355c90fbd56e952
SHA1 7457e40f3b9596c65c6021f574e2221ee7d71bd0
SHA512 9f87201458e1c7ad1dda63b6a07d9fb98bd698a6d58bf2fec9f319ac9914824f64cf2eebfb6cad93f665c59e1fae818d05442d9fbad59b0e93c825267c7a2a6b
SSDEEP 49152:JFgCTKEwfQU33bi3I06lzu5Unjs3V6UKOZEmTJ9EPljES7qRJx+GKIntIkdeuvCv:+m5UDUKOtEN6Az33fdm
TLSH
T1A9663A26A37901E9E0B7C13CCA976713F9B134890735ABD74691866A1F23BF49E3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_593921f33d93d7090355c90fbd56e952_blankgrabber_gazer_glassworm_helldown_icedid_mespinoza_njrat_remcos_ryuk_stealc

File Explorer

2026-08-13_593921f33d93d7090355c90fbd56e952_blankgrabber_gazer_glassworm_helldown_icedid_mespinoza_njrat_remcos_ryuk_stealc

.exe 6.3MB

2026-08-13_593921f33d93d7090355c90fbd56e952_blankgrabber_gazer_glassworm_helldown_icedid_mespinoza_njrat_remcos_ryuk_stealc

IMPHASH 7f75163e0aa4e87c2cf931bd14b21c1e
SHA256 008f5d53bbaf93c8a476191bac3c33a47918335701c1a036ef048000a44d610f
MD5 593921f33d93d7090355c90fbd56e952
SHA1 7457e40f3b9596c65c6021f574e2221ee7d71bd0
SHA512 9f87201458e1c7ad1dda63b6a07d9fb98bd698a6d58bf2fec9f319ac9914824f64cf2eebfb6cad93f665c59e1fae818d05442d9fbad59b0e93c825267c7a2a6b
SSDEEP 49152:JFgCTKEwfQU33bi3I06lzu5Unjs3V6UKOZEmTJ9EPljES7qRJx+GKIntIkdeuvCv:+m5UDUKOtEN6Az33fdm
TLSH
T1A9663A26A37901E9E0B7C13CCA976713F9B134890735ABD74691866A1F23BF49E3E350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4287568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\windows\Desktop\Rat\build\Propionanilide.pdb

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetCertificateContextProperty CertGetNameStringA CertOpenStore CertOpenSystemStoreA CryptStringToBinaryA CryptUnprotectData

user32

CloseClipboard GetAsyncKeyState GetClipboardData GetDC GetKeyNameTextA GetKeyboardState GetSystemMetrics MapVirtualKeyA OpenClipboard ReleaseDC SetProcessDPIAware ToUnicode

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI CloseHandle CloseThreadpoolTimer CloseThreadpoolWait CompareStringEx CompareStringW CopyFileW CreateDirectoryExW CreateDirectoryW CreateEventA CreateEventExW CreateFileA CreateFileMappingW CreateFileW CreateHardLinkW CreateMutexA CreateMutexW CreatePipe CreateProcessW CreateSemaphoreExW CreateSymbolicLinkW CreateThread CreateThreadpoolTimer CreateThreadpoolWait DecodePointer DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushProcessWriteBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeLibraryWhenCallbackReturns GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetEnvironmentStringsW GetExitCodeThread GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadTimes GetTickCount GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GlobalLock GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapQueryInformation HeapReAlloc HeapSize HeapValidate InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MoveFileExA MoveFileExW MultiByteToWideChar OutputDebugStringA OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetPriorityClass SetStdHandle SetThreadpoolTimer SetThreadpoolWait SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryAcquireSRWLockShared TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WaitForThreadpoolTimerCallbacks WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenRandom BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

advapi32

GetUserNameW

shell32

SHGetFolderPathA SHGetKnownFolderPath

ole32

CoTaskMemFree

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

wsock32

WSACleanup WSAGetLastError WSASetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect getsockname getsockopt inet_ntoa listen recv recvfrom select send setsockopt shutdown socket

ws2_32

WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAWaitForMultipleEvents freeaddrinfo getaddrinfo inet_ntop inet_pton

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

320KB

Virtual Size

352KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

263KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_guard_c

Size

512B

Virtual Size

36B

Characteristics

Name

_guard_d

Size

512B

Virtual Size

36B

Characteristics

Name

memcpy_

Size

512B

Virtual Size

264B

Characteristics

Name

.rsrc

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_593921f33d93d7090355c90fbd56e952_blankgrabber_gazer_glassworm_helldown_icedid_mespinoza_njrat_remcos_ryuk_stealc

crypt32

user32

gdi32

kernel32

bcrypt

advapi32

shell32

ole32

winhttp

wsock32

ws2_32

generic