General
- Target 2026-08-22_6b67e055b85c9c819c670be2b233afea_glassworm_icedid_njrat_ryuk
- Size 1.9MB
- Sample260823-hszxnahf28
- SHA256 f273dd865d6d9ace1b66ce549b891fb669b7585deadece2778b3d9e4270d7a79
- MD5 6b67e055b85c9c819c670be2b233afea
- SHA1 035f2b0b2d109af63b9f1905fa57c3b01f86df8a
- SHA512 d9f75f9031f936fbeadc8116abfbc29d681c395eb2af7a4ea2eb028c79d88a4a1c3d1d9fb3a8c06fe935270ce9c7b24972f565583e1610c33b1ee10c6d2e7a23
- SSDEEP 49152:6RhnS4EP4CRRVl8pjO1schvbLE4cdnbXoAktLD/p9qkVdWu8:6RUWK14dnStp9nPWu8
- TLSH T1E395BF5AB7A841B6D167C17DC953865AF3B2B4160B20D7DF0364836E2F23BE11E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_6b67e055b85c9c819c670be2b233afea_glassworm_icedid_njrat_ryuk.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_6b67e055b85c9c819c670be2b233afea_glassworm_icedid_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_6b67e055b85c9c819c670be2b233afea_glassworm_icedid_njrat_ryuk
- Size 1.9MB
- SHA256 f273dd865d6d9ace1b66ce549b891fb669b7585deadece2778b3d9e4270d7a79
- MD5 6b67e055b85c9c819c670be2b233afea
- SHA1 035f2b0b2d109af63b9f1905fa57c3b01f86df8a
- SHA512 d9f75f9031f936fbeadc8116abfbc29d681c395eb2af7a4ea2eb028c79d88a4a1c3d1d9fb3a8c06fe935270ce9c7b24972f565583e1610c33b1ee10c6d2e7a23
- SSDEEP 49152:6RhnS4EP4CRRVl8pjO1schvbLE4cdnbXoAktLD/p9qkVdWu8:6RUWK14dnStp9nPWu8
- TLSH T1E395BF5AB7A841B6D167C17DC953865AF3B2B4160B20D7DF0364836E2F23BE11E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Reflective DLL injection artifacts
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.