General
- Target 2026-09-23_b4470a12523513c3cc60bf6159982f55_glassworm_icedid_njrat_ponmocup_ryuk
- Size 15.3MB
- Sample260924-fb5epseb43
- SHA256 9b6f75ad16a6e9ebb46e5d96d6f9a20043cf6fd4aa4b0932346091e28f3af7cf
- MD5 b4470a12523513c3cc60bf6159982f55
- SHA1 a56b4085c4a4a3413a1ea1e041a3c8d2f1dfd1e7
- SHA512 9d93d7bb761a86461cb3ed0024790e9c36d6fe847a8a159235c06f19d06dc079a49735844197f15758befdbbcc3d993cda9ddbc05e672a5c06b779e528525a09
- SSDEEP 393216:Rl4DDxi9c5hlER35ShR4uw22WmfDZHZTtN3ZWAg9cXRw:P4XxOEhkpQ2z7/tN34Q
- TLSH T1B7F63346B252247CE442A277ECA16838C133B4075F59252F9B6D27348BF32ED7E74B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-09-23_b4470a12523513c3cc60bf6159982f55_glassworm_icedid_njrat_ponmocup_ryuk.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-23_b4470a12523513c3cc60bf6159982f55_glassworm_icedid_njrat_ponmocup_ryuk.exe
Resource
win11ltsc2024-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-23_b4470a12523513c3cc60bf6159982f55_glassworm_icedid_njrat_ponmocup_ryuk
- Size 15.3MB
- SHA256 9b6f75ad16a6e9ebb46e5d96d6f9a20043cf6fd4aa4b0932346091e28f3af7cf
- MD5 b4470a12523513c3cc60bf6159982f55
- SHA1 a56b4085c4a4a3413a1ea1e041a3c8d2f1dfd1e7
- SHA512 9d93d7bb761a86461cb3ed0024790e9c36d6fe847a8a159235c06f19d06dc079a49735844197f15758befdbbcc3d993cda9ddbc05e672a5c06b779e528525a09
- SSDEEP 393216:Rl4DDxi9c5hlER35ShR4uw22WmfDZHZTtN3ZWAg9cXRw:P4XxOEhkpQ2z7/tN34Q
- TLSH T1B7F63346B252247CE442A277ECA16838C133B4075F59252F9B6D27348BF32ED7E74B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory