General
- Target 2026-09-21_482ea3cbb398de6d5cae701799cd1291_glassworm_icedid_njrat_ryuk
- Size 62.0MB
- Sample260922-qs772afd92
- SHA256 03a2f0a3818bed026880936e59674e8c00c33575df92db95f5c8b1d27d1c15ec
- MD5 482ea3cbb398de6d5cae701799cd1291
- SHA1 c47ce2aff39ca177b17a177ebb1aef409607ae7a
- SHA512 58309fa83609c492dafbedd8c70dfa1190edc180d58a875790d3f51aa6a8e83de83ddaf4d66816e6a7f0493f75bb1bad54a1438f6581838441ab9025fef9d830
- SSDEEP 1572864:oQMTVCyLXGM/4XAxkW7DAelES5SCU/+/REiyiuq:ZMTMyLFYgkG8AjSC++/R7i
- TLSH T188E7335DF52104DAE47A2176BD59D02EC937B00E93C2D06E4474028BC2DFEBBAB366E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-09-21_482ea3cbb398de6d5cae701799cd1291_glassworm_icedid_njrat_ryuk.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-21_482ea3cbb398de6d5cae701799cd1291_glassworm_icedid_njrat_ryuk.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-21_482ea3cbb398de6d5cae701799cd1291_glassworm_icedid_njrat_ryuk
- Size 62.0MB
- SHA256 03a2f0a3818bed026880936e59674e8c00c33575df92db95f5c8b1d27d1c15ec
- MD5 482ea3cbb398de6d5cae701799cd1291
- SHA1 c47ce2aff39ca177b17a177ebb1aef409607ae7a
- SHA512 58309fa83609c492dafbedd8c70dfa1190edc180d58a875790d3f51aa6a8e83de83ddaf4d66816e6a7f0493f75bb1bad54a1438f6581838441ab9025fef9d830
- SSDEEP 1572864:oQMTVCyLXGM/4XAxkW7DAelES5SCU/+/REiyiuq:ZMTMyLFYgkG8AjSC++/R7i
- TLSH T188E7335DF52104DAE47A2176BD59D02EC937B00E93C2D06E4474028BC2DFEBBAB366E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.