2026-08-24_0639505087cb8165127bf62108f9887c_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

General

Target
2026-08-24_0639505087cb8165127bf62108f9887c_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc
Size 5.8MB
Sample260825-ym477avwev
SHA256 7ebe80c25d8dd9ad11ba6af51a59aa6209d5d3f21aee86018948e51b7f6f8b75
MD5 0639505087cb8165127bf62108f9887c
SHA1 850d9bd031b28cc857773d0a187371045ca81c46
SHA512 940fc210bad722988e57cc74818776201356724a41a465863de4b75562b2b76047082591953058f36e501efb7f5eb299b07d2688b927324ae2acdfc34619c016
SSDEEP 98304:/QCXsFXOPQUCSfQuvD5KCYmBOyQfY7J0ZH:/QCXsFXOPQX6KeUyQA7J0Z
TLSH
T13556AF1B629402ACE177C17DCBDB8E57E6727409035196CB06D486AA1F53EE84FBF322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_0639505087cb8165127bf62108f9887c_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-24_0639505087cb8165127bf62108f9887c_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

.exe 5.8MB

2026-08-24_0639505087cb8165127bf62108f9887c_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH 8fa512b07414add40d20eaadcdb26ad5
SHA256 7ebe80c25d8dd9ad11ba6af51a59aa6209d5d3f21aee86018948e51b7f6f8b75
MD5 0639505087cb8165127bf62108f9887c
SHA1 850d9bd031b28cc857773d0a187371045ca81c46
SHA512 940fc210bad722988e57cc74818776201356724a41a465863de4b75562b2b76047082591953058f36e501efb7f5eb299b07d2688b927324ae2acdfc34619c016
SSDEEP 98304:/QCXsFXOPQUCSfQuvD5KCYmBOyQfY7J0ZH:/QCXsFXOPQX6KeUyQA7J0Z
TLSH
T13556AF1B629402ACE177C17DCBDB8E57E6727409035196CB06D486AA1F53EE84FBF322
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

3441840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\martin\develop\cpp\dvisvgm\vc\x64\Release\dvisvgm.pdb

kernel32

GetTempFileNameA GetFileAttributesExA GetCurrentDirectoryA GetTempPathA GetFileAttributesA GetProcAddress ReadFile SetHandleInformation TerminateProcess CreatePipe FreeLibrary WaitForSingleObject CreateFileA CloseHandle CreateProcessA GetExitCodeProcess GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle GetConsoleCursorInfo SetConsoleCursorInfo HeapSize LoadLibraryA FindClose FindNextFileA PeekNamedPipe FindFirstFileA WriteConsoleW OutputDebugStringW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetTimeZoneInformation HeapReAlloc FormatMessageA WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LocalFree GetLocaleInfoEx MultiByteToWideChar LCMapStringEx SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetFileInformationByHandleEx CreateSymbolicLinkW CompareStringEx GetCPInfo GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetLastError RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList SetLastError RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateFileW GetFileType WriteFile GetConsoleOutputCP GetConsoleMode SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW SetConsoleCtrlHandler ExitProcess GetModuleHandleExW GetModuleFileNameW GetCommandLineA GetCommandLineW GetCurrentThread HeapFree HeapAlloc GetFileSizeEx SetFilePointerEx FlushFileBuffers FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW SetStdHandle SetEndOfFile CreateProcessW GetFileAttributesExW RemoveDirectoryW DeleteFileW MoveFileExW CreateDirectoryW

advapi32

RegCloseKey RegGetValueA RegOpenKeyExA RegEnumKeyA

ole32

CoUninitialize CLSIDFromProgID OleRun CLSIDFromString CoCreateInstance CoInitialize

oleaut32

SysFreeString SysStringByteLen SysAllocStringByteLen SysAllocString SetErrorInfo VariantChangeType VariantClear VariantInit GetErrorInfo CreateErrorInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_0639505087cb8165127bf62108f9887c_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

ole32

oleaut32

generic