2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc
Size 9.4MB
Sample260901-2mcdysck4v
SHA256 939f688c233f5779bb737a5a573885436d5b4dd1a18ef57cc1e8aaef416764e0
MD5 fe430427335a4a2c1d4ef63a3af0b218
SHA1 049423b1ca8c829f4b37c952fc357d90237e58c4
SHA512 85125a86978b21a28dc61c5225c79b112a455be77be8a57c521140805513a5089a1b8875e43731d4574163f43cdb803f5fce8cfd881ad8cf5681345cf683fdcc
SSDEEP 196608:e83DGUbeWpQj3emtIpt+h+UOjtP+cR5X:RzPbeWpQj3emtIpt+h+UOZP+O
TLSH
T1D6A68C55E37800D8D4ABC2B8C7465253D771744A03B0ABDF1B90AEA62F33AE51E7B712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc

File Explorer

2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc

.exe 9.4MB

2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc

IMPHASH f70781ca0c3298f5e31d68a24b19b8ee
SHA256 939f688c233f5779bb737a5a573885436d5b4dd1a18ef57cc1e8aaef416764e0
MD5 fe430427335a4a2c1d4ef63a3af0b218
SHA1 049423b1ca8c829f4b37c952fc357d90237e58c4
SHA512 85125a86978b21a28dc61c5225c79b112a455be77be8a57c521140805513a5089a1b8875e43731d4574163f43cdb803f5fce8cfd881ad8cf5681345cf683fdcc
SSDEEP 196608:e83DGUbeWpQj3emtIpt+h+UOjtP+cR5X:RzPbeWpQj3emtIpt+h+UOZP+O
TLSH
T1D6A68C55E37800D8D4ABC2B8C7465253D771744A03B0ABDF1B90AEA62F33AE51E7B712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c2:8b:28:71:d5:ad:ef:a0:55:40:bb:15:4a:42:74:6c:3e:16:64:23:80:f5:f2:6a:1d:da:ea:be:76:17:da:08

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 8, 2026

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:9a:57:99:d4:1e:e6:32:2d:2e:00:00:00:00:05:9a

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Oct 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

7033508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

GetTokenInformation RegOpenKeyExA OpenProcessToken RegSetValueExA GetUserNameA RegCreateKeyExA RegQueryValueExA RegCloseKey RegDeleteTreeA RegEnumKeyExA RegEnumValueA RegQueryInfoKeyA CredFree CredEnumerateA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt RegOpenKeyExW CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptGenRandom ReportEventW RegisterEventSourceW DeregisterEventSource RegQueryValueExW

secur32

InitSecurityInterfaceW

bcrypt

BCryptDestroyKey BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey

crypt32

CryptUnprotectData CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertFreeCRLContext CertAddCertificateContextToStore CertFreeCTLContext CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertDuplicateCertificateContext CertGetCertificateContextProperty CertOpenSystemStoreW CryptStringToBinaryA CertOpenStore

ws2_32

WSACloseEvent send sendto WSACreateEvent WSAEnumNetworkEvents WSAEventSelect inet_ntop WSAResetEvent WSAWaitForMultipleEvents WSAGetLastError closesocket htons socket ntohs WSAStartup WSACleanup accept shutdown getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr gethostbyname gethostname ioctlsocket getsockopt recvfrom freeaddrinfo getaddrinfo listen htonl select __WSAFDIsSet WSAIoctl WSASetLastError setsockopt recv getsockname getpeername connect bind

shell32

DragQueryFileW ShellExecuteExA ShellExecuteA SHGetFolderPathA

user32

FindWindowA GetCursorPos MessageBoxA ShowWindow GetSystemMetrics MonitorFromWindow DestroyWindow GetLastInputInfo MessageBoxW GetUserObjectInformationW SendMessageA EnumDisplayDevicesA ReleaseDC IsClipboardFormatAvailable GetProcessWindowStation DispatchMessageA CallNextHookEx GetKeyboardState GetAsyncKeyState SetWindowsHookExA GetWindowTextA MapVirtualKeyA GetForegroundWindow UnhookWindowsHookEx TranslateMessage ToUnicode PeekMessageA GetClipboardData CloseClipboard OpenClipboard GetDC EmptyClipboard SetClipboardData EnumDisplayMonitors GetMonitorInfoA

ntdll

RtlVirtualUnwind VerSetConditionMask RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RtlUnwind

wlanapi

WlanQueryInterface WlanFreeMemory WlanCloseHandle WlanOpenHandle WlanGetProfile WlanGetProfileList WlanEnumInterfaces

ole32

CoCreateInstance CoUninitialize CoInitializeEx

gdi32

CreateCompatibleDC SelectObject GetObjectA CreateCompatibleBitmap BitBlt GetDeviceCaps DeleteObject GetDIBits DeleteDC

iphlpapi

if_nametoindex GetAdaptersAddresses GetAdaptersInfo

kernel32

GetDriveTypeW FreeLibraryAndExitThread ExitThread InitializeCriticalSectionAndSpinCount InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SystemTimeToTzSpecificLocalTime GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer LoadLibraryExW TryAcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable GetLocaleInfoEx CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFileW DeviceIoControl SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle FindFirstFileExW CreateDirectoryW GetCurrentDirectoryW FileTimeToSystemTime GetConsoleOutputCP SetFilePointerEx WriteConsoleW SetConsoleCtrlHandler FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode FindNextFileW FindFirstFileW FindClose CreateSemaphoreA GetExitCodeThread ReleaseSemaphore GetACP GetEnvironmentVariableW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW GetSystemFirmwareTable GetModuleFileNameA OpenEventA SizeofResource VirtualProtect GetCurrentProcess SetFileTime GetModuleFileNameW FindResourceA CreateMutexA WaitForSingleObject GetSystemDirectoryW UnmapViewOfFile GetModuleHandleA CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTempPathA GetTickCount64 GetLastError GetFileAttributesA Process32NextW CreateFileA GetCurrentThread GetSystemDirectoryA LoadLibraryA LockResource QueryPerformanceFrequency Process32FirstW CloseHandle GetSystemInfo GetWindowsDirectoryA LoadResource AddVectoredExceptionHandler GetThreadContext GetProcAddress CreateFileMappingA GetFileSize ExitProcess GlobalMemoryStatusEx CreateProcessW FreeLibrary WideCharToMultiByte GetConsoleWindow CreateProcessA GetDiskFreeSpaceExA MapViewOfFile QueryPerformanceCounter GetTickCount GetFileTime IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent GetEnvironmentVariableA OpenProcess K32GetModuleFileNameExA OutputDebugStringA TerminateProcess GetExitCodeProcess GlobalLock GlobalUnlock GetLogicalDrives GetDriveTypeA GetUserDefaultLocaleName GetLocaleInfoA GetTimeZoneInformation QueryFullProcessImageNameA ReadFile WriteFile GlobalAlloc Process32First Process32Next ExpandEnvironmentStringsA LocalFree GetCurrentProcessId ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError CreateFileW GetFullPathNameW MoveFileExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx FormatMessageA WaitForSingleObjectEx CreateThread GetModuleHandleW GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx FlushFileBuffers CreateFileMappingW GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetNativeSystemInfo HeapReAlloc DeleteFileW DeleteFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate GetFileAttributesW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection TryEnterCriticalSection GetCurrentThreadId InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW VirtualFree

Name

.text

Size

7.0MB

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

53KB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

264KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc

PE Signature issue

advapi32

secur32

bcrypt

crypt32

ws2_32

shell32

user32

ntdll

wlanapi

ole32

gdi32

iphlpapi

kernel32

generic