2026-08-13_e01f225c8b87edb71b3f4b1baf3ef381_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

General

Target
2026-08-13_e01f225c8b87edb71b3f4b1baf3ef381_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc
Size 1.8MB
Sample260813-yllz8axdnc
SHA256 f1cc48ea00aa1d9a63c45d8a8f4f9b9f376dcee74231d0ea988a36802832e5cb
MD5 e01f225c8b87edb71b3f4b1baf3ef381
SHA1 4e7829ee54292b869eca2f6454d0e7a491c10218
SHA512 1af26470ca881aa33291431fd654974c6ca5ffcc6464906a315517206cd532fe33b821b98fcfebdd4a2fc0468cc1cf709cbe8f09a49b7a0890cbd48519d0b4b0
SSDEEP 24576:eMSpIKhBgxdIWJGx32qPrl73sMcZNe6MitB1+ZXHrRsEONHZEurwsvKgzoVo:elpIWxNPrl7eeA0oEON6udzr
TLSH
T175957E47A3B401FCD1A7C178C9565A07EBB178091770ABDB16D09AA66F23EE11F7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_e01f225c8b87edb71b3f4b1baf3ef381_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-13_e01f225c8b87edb71b3f4b1baf3ef381_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

.exe 1.8MB

2026-08-13_e01f225c8b87edb71b3f4b1baf3ef381_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH b664cca7af05ffe4e7e5d5dea5eba7d1
SHA256 f1cc48ea00aa1d9a63c45d8a8f4f9b9f376dcee74231d0ea988a36802832e5cb
MD5 e01f225c8b87edb71b3f4b1baf3ef381
SHA1 4e7829ee54292b869eca2f6454d0e7a491c10218
SHA512 1af26470ca881aa33291431fd654974c6ca5ffcc6464906a315517206cd532fe33b821b98fcfebdd4a2fc0468cc1cf709cbe8f09a49b7a0890cbd48519d0b4b0
SSDEEP 24576:eMSpIKhBgxdIWJGx32qPrl73sMcZNe6MitB1+ZXHrRsEONHZEurwsvKgzoVo:elpIWxNPrl7eeA0oEON6udzr
TLSH
T175957E47A3B401FCD1A7C178C9565A07EBB178091770ABDB16D09AA66F23EE11F7E320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1355768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

GetTokenInformation RevertToSelf RegCloseKey RegOpenKeyExW RegQueryValueExW GetSecurityInfo OpenProcessToken

bcrypt

BCryptDeriveKeyPBKDF2 BCryptGenRandom BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptOpenAlgorithmProvider BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptDestroyKey

kernel32

WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW GetConsoleMode CloseHandle GetCurrentProcess GetModuleFileNameW MultiByteToWideChar FreeConsole AllocConsole AttachConsole GetLastError GetCurrentThread OpenProcess FreeLibrary GetProcAddress LoadLibraryExW AddDllDirectory SetDefaultDllDirectories LocalFree SetDllDirectoryW CreateToolhelp32Snapshot Process32FirstW Process32NextW WaitForSingleObject TerminateProcess CreateProcessW CreateFileW ReadFile WriteFile QueryDosDeviceW DuplicateHandle GetCurrentProcessId CreateThread TerminateThread WideCharToMultiByte GetModuleHandleW LoadLibraryW GetEnvironmentVariableW ExpandEnvironmentStringsW FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId FindFirstFileW SetFileAttributesW MoveFileExW GetFileType GetFileSizeEx GetFileTime SetFilePointerEx GetConsoleOutputCP GetLocaleInfoEx SetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileInformationByHandle CopyFileW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW RtlUnwind

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

261KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_e01f225c8b87edb71b3f4b1baf3ef381_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

advapi32

bcrypt

kernel32

generic