2026-09-04_94ff2626d5e5306833d528c0173c5110_blankgrabber_glassworm_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_94ff2626d5e5306833d528c0173c5110_blankgrabber_glassworm_icedid_njrat_stealc
Size 2.6MB
Sample260905-dh66rssvfw
SHA256 70f2095a97acc85b007883f88b36e161ec5b94a24750a9b4bd2dd1b9c6d255a8
MD5 94ff2626d5e5306833d528c0173c5110
SHA1 2bdb348e43dd27e8096a3f5c891a9d2aa45873df
SHA512 5da8edd3a64ba8c50f63bb5e1a87fdbfb7a52145832a64b6b87b4e0df278a887d6335b01d2044eee2e7e51d6b1090fd16f76f5b5b7ee14dadbe38356a3232d1e
SSDEEP 49152:Bm+NLUZb5gBPc4cthUd8QES0kAPELkVOu4BSgn+88:7NYmP8bi
TLSH
T17ED5BF06B39941E9C0A6E078CD56971BEBB274081331B7DB23E88A651F73AE04E7F751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_94ff2626d5e5306833d528c0173c5110_blankgrabber_glassworm_icedid_njrat_stealc

File Explorer

2026-09-04_94ff2626d5e5306833d528c0173c5110_blankgrabber_glassworm_icedid_njrat_stealc

.exe 2.6MB

2026-09-04_94ff2626d5e5306833d528c0173c5110_blankgrabber_glassworm_icedid_njrat_stealc

IMPHASH 97d0ca4b272f56884c94de582f85e1de
SHA256 70f2095a97acc85b007883f88b36e161ec5b94a24750a9b4bd2dd1b9c6d255a8
MD5 94ff2626d5e5306833d528c0173c5110
SHA1 2bdb348e43dd27e8096a3f5c891a9d2aa45873df
SHA512 5da8edd3a64ba8c50f63bb5e1a87fdbfb7a52145832a64b6b87b4e0df278a887d6335b01d2044eee2e7e51d6b1090fd16f76f5b5b7ee14dadbe38356a3232d1e
SSDEEP 49152:Bm+NLUZb5gBPc4cthUd8QES0kAPELkVOu4BSgn+88:7NYmP8bi
TLSH
T17ED5BF06B39941E9C0A6E078CD56971BEBB274081331B7DB23E88A651F73AE04E7F751
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1491908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\eblan\Desktop\dotify_fixed\x64\Release\cs2-external-esp.pdb

ws2_32

send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError gethostname ioctlsocket getpeername sendto recvfrom freeaddrinfo getaddrinfo recv listen htonl getsockname connect bind accept select __WSAFDIsSet socket htons WSAIoctl setsockopt inet_pton WSACleanup WSAStartup inet_ntop WSASetLastError ntohs getsockopt

crypt32

CertCloseStore CertFindExtension CertOpenStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CertGetNameStringW CryptDecodeObjectEx CryptQueryObject CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertAddCertificateContextToStore

bcrypt

BCryptGenRandom

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

winmm

PlaySoundA

kernel32

ReadConsoleW GetConsoleOutputCP HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetCommandLineA WriteFile GetModuleFileNameW ExitProcess SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread MoveFileExA GetLastError GetProcAddress GetModuleHandleA GetModuleHandleW GetConsoleWindow GetStdHandle SetConsoleTitleA SetConsoleOutputCP GetConsoleMode SetConsoleMode MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle OpenProcess K32EnumProcessModulesEx K32GetModuleInformation Module32FirstW Module32NextW QueryFullProcessImageNameA VirtualQueryEx GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA FreeLibrary VerSetConditionMask GlobalLock WideCharToMultiByte GlobalUnlock GlobalAlloc GlobalFree VirtualQuery AddVectoredExceptionHandler SetPriorityClass GetCurrentProcess GetModuleFileNameA GetTickCount64 SetLastError ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetUserDefaultLCID LoadLibraryW Sleep FormatMessageW MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId SleepEx VerifyVersionInfoW CreateFileW GetFileSizeEx LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx GetStringTypeW CreateThread GetSystemTimeAsFileTime LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable WakeConditionVariable SleepConditionVariableSRW GetExitCodeThread GetCurrentThreadId TryAcquireSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetCurrentDirectoryW GetLocaleInfoEx LocalFree FormatMessageA GetCommandLineW EnumSystemLocalesW ExitThread FlushFileBuffers HeapReAlloc SetStdHandle SetEndOfFile GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap DeleteFileW HeapSize WriteConsoleW GetSystemDirectoryW RtlUnwind

user32

SetWindowDisplayAffinity GetWindowLongPtrA DispatchMessageA PeekMessageA UnregisterClassA UpdateWindow CreateWindowExA RegisterClassExA GetWindowRect IsWindow GetKeyNameTextA MapVirtualKeyA MessageBoxA SetClipboardData EmptyClipboard CloseClipboard GetClipboardData OpenClipboard UnregisterClassW RegisterClassExW DefWindowProcA GetPropA SetLayeredWindowAttributes SetWindowLongW DefWindowProcW IsIconic SetFocus SetForegroundWindow BringWindowToTop GetWindowLongW SetWindowLongA ShowWindow SetWindowLongPtrA DestroyWindow CreateWindowExW AdjustWindowRectEx MonitorFromWindow ReleaseDC GetWindowDisplayAffinity SetProcessDPIAware SetWindowPos IsWindowUnicode ReleaseCapture SetCapture GetCapture TrackMouseEvent GetMessageExtraInfo EnumDisplayMonitors GetMonitorInfoA WindowFromPoint ScreenToClient SetCursorPos ClientToScreen IsChild GetKeyState LoadCursorA SetCursor SetPropA GetKeyboardLayout IsWindowVisible GetWindowTextA FindWindowExA GetWindowThreadProcessId PostMessageA GetClientRect keybd_event UnhookWindowsHookEx GetMessageW SetWindowsHookExW SendInput DispatchMessageW TranslateMessage PeekMessageW CallNextHookEx mouse_event GetSystemMetrics GetForegroundWindow GetAsyncKeyState GetDC GetCursorPos

gdi32

GetDeviceCaps

advapi32

CryptDestroyKey CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptEncrypt CryptImportKey CryptAcquireContextW CryptDestroyHash

shell32

ShellExecuteW

d3dcompiler_47

D3DCompile

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

802KB

Virtual Size

801KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_94ff2626d5e5306833d528c0173c5110_blankgrabber_glassworm_icedid_njrat_stealc

ws2_32

crypt32

bcrypt

dwmapi

d3d11

winmm

kernel32

user32

gdi32

advapi32

shell32

d3dcompiler_47

imm32

generic