General
- Target 2026-09-23_27d248bdb6bb36ae1c55d421e4f5a07b_glassworm_icedid_njrat_ponmocup_ryuk
- Size 15.3MB
- Sample260924-pca2xsde53
- SHA256 4d9616aaba7304f49b7190e9e68c585fc8fbaca67cb245cc6c28ff67d74adfef
- MD5 27d248bdb6bb36ae1c55d421e4f5a07b
- SHA1 42df62d415a45def51fca8b2a8b2d34b2cd14dd6
- SHA512 4b9766e87f0b487e76391b1aa82a4e46664a6624eeaf36e87a0ed04b1a8037f01df11a22d646c1f978aaa81087a595559348ba6f74539014de2e3ed565521add
- SSDEEP 393216:Ol4DDxi9c5hlER35ShR4uw22WmfDZHZTtN3ZWAgtU+D:g4XxOEhkpQ2z7/tN34
- TLSH T159F63346B212157CE442E277ECA168388133F4175F58652F6B6C23349BE32ED3E75B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-09-23_27d248bdb6bb36ae1c55d421e4f5a07b_glassworm_icedid_njrat_ponmocup_ryuk.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-23_27d248bdb6bb36ae1c55d421e4f5a07b_glassworm_icedid_njrat_ponmocup_ryuk.exe
Resource
win11ltsc2024-20260911-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-23_27d248bdb6bb36ae1c55d421e4f5a07b_glassworm_icedid_njrat_ponmocup_ryuk
- Size 15.3MB
- SHA256 4d9616aaba7304f49b7190e9e68c585fc8fbaca67cb245cc6c28ff67d74adfef
- MD5 27d248bdb6bb36ae1c55d421e4f5a07b
- SHA1 42df62d415a45def51fca8b2a8b2d34b2cd14dd6
- SHA512 4b9766e87f0b487e76391b1aa82a4e46664a6624eeaf36e87a0ed04b1a8037f01df11a22d646c1f978aaa81087a595559348ba6f74539014de2e3ed565521add
- SSDEEP 393216:Ol4DDxi9c5hlER35ShR4uw22WmfDZHZTtN3ZWAgtU+D:g4XxOEhkpQ2z7/tN34
- TLSH T159F63346B212157CE442E277ECA168388133F4175F58652F6B6C23349BE32ED3E75B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.