2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk
Size 5.1MB
Sample260929-prswaazfnd
SHA256 a6a2f4915718bead91b3da98bb0b762be1e4940fa0238e4ca3d6808dff2b78e0
MD5 02b6dcd0757ef5f907cc76d4c9f3c970
SHA1 85d88d655888d871d2df2e34665f4dc1722e1429
SHA512 6f8902267e522574c97b282bc4bec13ae21d88f03587a98f249c7f756e359c450262eeb04af09cfab43d55a2741fa819e5c50f86e00884433e2caee3fc016375
SSDEEP 98304:PssF9QGJmURrloXGH5G3xJdG+u0+Yf4i:pF9QGJmojZ+dGAy
TLSH
T1AD367C03E2A580F8C09EC178835BD533EA72BC894935B6AF1BD48B612F66F50AF1D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk

File Explorer

2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk

.exe 5.1MB

2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk

IMPHASH 7b2d02d5c8f927843d8f0a1a48fb8302
SHA256 a6a2f4915718bead91b3da98bb0b762be1e4940fa0238e4ca3d6808dff2b78e0
MD5 02b6dcd0757ef5f907cc76d4c9f3c970
SHA1 85d88d655888d871d2df2e34665f4dc1722e1429
SHA512 6f8902267e522574c97b282bc4bec13ae21d88f03587a98f249c7f756e359c450262eeb04af09cfab43d55a2741fa819e5c50f86e00884433e2caee3fc016375
SSDEEP 98304:PssF9QGJmURrloXGH5G3xJdG+u0+Yf4i:pF9QGJmojZ+dGAy
TLSH
T1AD367C03E2A580F8C09EC178835BD533EA72BC894935B6AF1BD48B612F66F50AF1D715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3603984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

app.pdb

crypt32

CryptProtectData CryptUnprotectData

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CloseHandle CompareStringOrdinal CompareStringW CreateDirectoryW CreateEventW CreateFileW CreateIoCompletionPort CreateMutexA CreateProcessW CreateThread CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW FlsAlloc FlsFree FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemTimeAsFileTime GetTempPathW GetTimeZoneInformation GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree LockFileEx MoveFileExW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadFileEx ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleMode SetConsoleTextAttribute SetEndOfFile SetEnvironmentVariableA SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW

wininet

InternetSetOptionW

user32

AdjustWindowRectEx CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard EnableWindow GetClientRect GetDC GetFocus GetMessageW GetWindowLongPtrW GetWindowLongW InvalidateRect IsDialogMessageW KillTimer LoadCursorW MessageBoxW MoveWindow OpenClipboard PostMessageW PostQuitMessage RegisterClassExW ReleaseDC SendMessageW SetClipboardData SetFocus SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow TranslateMessage UpdateWindow

gdi32

CreateFontIndirectW CreateSolidBrush DeleteObject GetDeviceCaps GetStockObject SetBkMode SetTextColor

comctl32

InitCommonControlsEx

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

shell32

ShellExecuteW

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv select send setsockopt shutdown

bcrypt

BCryptGenRandom

advapi32

RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW SystemFunction036

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

117KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

433B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

712B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_02b6dcd0757ef5f907cc76d4c9f3c970_glassworm_icedid_megazord_njrat_ryuk

crypt32

kernel32

wininet

user32

gdi32

comctl32

ntdll

shell32

ws2_32

bcrypt

advapi32

generic