General
- Target 2026-09-23_f50cc7f42d0257928562c85673aedc17_glassworm_icedid_njrat_ponmocup_ryuk
- Size 15.3MB
- Sample260924-e92wss1y3p
- SHA256 50c271cf9091d3ec163e86ace3e877ee99e85f2b34841e263a5ca24ebf315c4a
- MD5 f50cc7f42d0257928562c85673aedc17
- SHA1 9f8ad253b205cef87d285a7836490c610cfc92a0
- SHA512 800242ab3bf6365c4141584ea51371ab6227962a65a6b9bc07ef19875d7e2379e104d1d0538b8d68d060133113e20246feb85986ba48659580ac824ae5ef834a
- SSDEEP 393216:Dl4DDxi9c5hlER35ShR4uw22WmfDZHZTtN3ZWAgAVmxw:J4XxOEhkpQ2z7/tN34R
- TLSH T1EBF63306B222147CE442E277ECA268788133F4175F59651F6A6C23349BE32FD3E75B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-09-23_f50cc7f42d0257928562c85673aedc17_glassworm_icedid_njrat_ponmocup_ryuk.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-23_f50cc7f42d0257928562c85673aedc17_glassworm_icedid_njrat_ponmocup_ryuk.exe
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-23_f50cc7f42d0257928562c85673aedc17_glassworm_icedid_njrat_ponmocup_ryuk
- Size 15.3MB
- SHA256 50c271cf9091d3ec163e86ace3e877ee99e85f2b34841e263a5ca24ebf315c4a
- MD5 f50cc7f42d0257928562c85673aedc17
- SHA1 9f8ad253b205cef87d285a7836490c610cfc92a0
- SHA512 800242ab3bf6365c4141584ea51371ab6227962a65a6b9bc07ef19875d7e2379e104d1d0538b8d68d060133113e20246feb85986ba48659580ac824ae5ef834a
- SSDEEP 393216:Dl4DDxi9c5hlER35ShR4uw22WmfDZHZTtN3ZWAgAVmxw:J4XxOEhkpQ2z7/tN34R
- TLSH T1EBF63306B222147CE442E277ECA268788133F4175F59651F6A6C23349BE32FD3E75B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.