2026-09-27_03fe9bdf60443c7e227ca26012d45b6a_glassworm_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-27_03fe9bdf60443c7e227ca26012d45b6a_glassworm_icedid_njrat_ryuk
Size 13.6MB
Sample260928-lc6baaaa54
SHA256 3e33cd7ca31188eb6d0085ea226d21981ee1cb7d6080bc417666740301bc684f
MD5 03fe9bdf60443c7e227ca26012d45b6a
SHA1 0066bb4562e2b59913aa1588cc30ce23764b54c2
SHA512 204bc9815b0da781c7354b5d0d89e0452733c77cbb5d753705d01f563a7dbeb8932a52f5f8929125abefb70400d1dae6f18e317d9986f0d9e6cf3f438ee277d2
SSDEEP 196608:c7nDw/3VJIL47nLg3mPKp9DgGFyZMfHEx:2k/HNnLgUo9DgGFyZf
TLSH
T1D3E6AC13F29A01D9D05DC1B98B5A9232EA71BC490B75B2DF1A5077922E77EE07B3C720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-27_03fe9bdf60443c7e227ca26012d45b6a_glassworm_icedid_njrat_ryuk

File Explorer

2026-09-27_03fe9bdf60443c7e227ca26012d45b6a_glassworm_icedid_njrat_ryuk

.exe 13.6MB

2026-09-27_03fe9bdf60443c7e227ca26012d45b6a_glassworm_icedid_njrat_ryuk

IMPHASH d01f262fcfefb7656f7ef05137ab4689
SHA256 3e33cd7ca31188eb6d0085ea226d21981ee1cb7d6080bc417666740301bc684f
MD5 03fe9bdf60443c7e227ca26012d45b6a
SHA1 0066bb4562e2b59913aa1588cc30ce23764b54c2
SHA512 204bc9815b0da781c7354b5d0d89e0452733c77cbb5d753705d01f563a7dbeb8932a52f5f8929125abefb70400d1dae6f18e317d9986f0d9e6cf3f438ee277d2
SSDEEP 196608:c7nDw/3VJIL47nLg3mPKp9DgGFyZMfHEx:2k/HNnLgUo9DgGFyZf
TLSH
T1D3E6AC13F29A01D9D05DC1B98B5A9232EA71BC490B75B2DF1A5077922E77EE07B3C720
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4737104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mxupdater.exe.pdb

advapi32

BuildTrusteeWithSidW CheckTokenMembership ConvertStringSidToSidW CreateProcessAsUserW GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetTokenInformation IsValidAcl IsValidSecurityDescriptor IsValidSid RegCloseKey RegCreateKeyExW RegNotifyChangeKeyValue RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW SetEntriesInAclW SetNamedSecurityInfoW SetSecurityInfo

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

user32

AllowSetForegroundWindow CallMsgFilterW CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetActiveWindow GetQueueStatus KillTimer MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW SetTimer TranslateMessage UnregisterClassW

ws2_32

WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEnumProtocolsW WSAEventSelect WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecv WSARecvFrom WSAResetEvent WSASend WSASendTo WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname gethostname getpeername getsockname getsockopt htonl htons inet_ntoa inet_ntop ioctlsocket ntohs recv recvfrom sendto setsockopt shutdown socket

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI AssignProcessToJobObject CancelIo CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileA DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFullPathNameA GetFullPathNameW GetGeoInfoW GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetThreadPriorityBoost GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserGeoID GetVersionExW GetWindowsDirectoryW GlobalFree GlobalMemoryStatusEx HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus PrefetchVirtualMemory Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetStdHandle SetThreadInformation SetThreadPriority SetThreadPriorityBoost SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SuspendThread SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryEnterCriticalSection TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcmpiA

iphlpapi

GetAdaptersAddresses if_indextoname

rpcrt4

UuidFromStringA

ntdll

NtQueryInformationThread NtQueryObject RtlGetLastNtStatus

winmm

timeBeginPeriod timeEndPeriod timeGetTime

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

shlwapi

PathMatchSpecW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ole32

CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

secur32

AcquireCredentialsHandleW DeleteSecurityContext FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW QuerySecurityPackageInfoW

winhttp

WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen WinHttpSetTimeouts

crypt32

CertAddStoreToCollection CertCloseStore CertControlStore CertEnumCertificatesInStore CertFindCertificateInStore CertGetEnhancedKeyUsage CertOpenStore CryptProtectMemory CryptUnprotectMemory

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize

ncrypt

NCryptCreatePersistedKey NCryptExportKey NCryptFinalizeKey NCryptFreeObject NCryptGetProperty NCryptImportKey NCryptIsAlgSupported NCryptOpenKey NCryptOpenStorageProvider NCryptSignHash

Name

.text

Size

8.8MB

Virtual Size

8.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

272KB

Virtual Size

272KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

729B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

LZMADEC

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

195B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-27_03fe9bdf60443c7e227ca26012d45b6a_glassworm_icedid_njrat_ryuk

advapi32

dbghelp

user32

ws2_32

kernel32

iphlpapi

rpcrt4

ntdll

winmm

userenv

shell32

shlwapi

version

ole32

secur32

winhttp

crypt32

api-ms-win-core-winrt-l1-1-0

ncrypt

generic