2026-10-11_889e87cf87d69563a6f805c97c3a3e3e_glassworm_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_889e87cf87d69563a6f805c97c3a3e3e_glassworm_icedid_njrat_ryuk
Size 947KB
Sample261012-vdthjseb88
SHA256 17e58dd9f9e1d50a0176ff1567aa94a6886a6a531667b3b3a420bca43bdcc77c
MD5 889e87cf87d69563a6f805c97c3a3e3e
SHA1 c3528aeaaf8848437814da618e0493eb707bc3e1
SHA512 39d2023431a70f0dbd7e3aab513fb5dc96c4924ed7573c6a662d35f8bc7405702d841cc16b6e93cc1bdc2bc8d7f2513a74f517448250adea10000960a460be7e
SSDEEP 12288:wbTsbhct7LrBYxHHGp/yumshFUPGQs3C6Fm:4sbhctGnGp/yfcWPGnC6Fm
TLSH
T1E5256B5EF7B500F4E8B6D0388A52622BF9B1B42947349BDB46548B562F32BF1963F301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_889e87cf87d69563a6f805c97c3a3e3e_glassworm_icedid_njrat_ryuk

File Explorer

2026-10-11_889e87cf87d69563a6f805c97c3a3e3e_glassworm_icedid_njrat_ryuk

.exe 947KB

2026-10-11_889e87cf87d69563a6f805c97c3a3e3e_glassworm_icedid_njrat_ryuk

IMPHASH 07cbfb6063dec836033569e5d69bad18
SHA256 17e58dd9f9e1d50a0176ff1567aa94a6886a6a531667b3b3a420bca43bdcc77c
MD5 889e87cf87d69563a6f805c97c3a3e3e
SHA1 c3528aeaaf8848437814da618e0493eb707bc3e1
SHA512 39d2023431a70f0dbd7e3aab513fb5dc96c4924ed7573c6a662d35f8bc7405702d841cc16b6e93cc1bdc2bc8d7f2513a74f517448250adea10000960a460be7e
SSDEEP 12288:wbTsbhct7LrBYxHHGp/yumshFUPGQs3C6Fm:4sbhctGnGp/yfcWPGnC6Fm
TLSH
T1E5256B5EF7B500F4E8B6D0388A52622BF9B1B42947349BDB46548B562F32BF1963F301
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

481488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

sshd.pdb

libcrypto

AES_set_encrypt_key DSA_SIG_new DSA_SIG_free RSA_public_decrypt EVP_CIPHER_CTX_get_app_data BN_div RSA_size EC_POINT_oct2point AES_encrypt BN_bn2bin RSA_sign DSA_do_sign EC_GROUP_get_degree ECDSA_SIG_free ECDSA_SIG_new EC_POINT_point2oct RAND_status ECDSA_do_sign SSLeay EVP_sha384 DSA_do_verify EVP_MD_CTX_copy_ex EVP_MD_CTX_cleanup EVP_md5 EVP_sha256 DH_size DH_free EVP_DigestUpdate EVP_Digest EVP_DigestInit_ex EC_KEY_new_by_curve_name BN_bin2bn EC_KEY_get0_group DH_compute_key ECDSA_do_verify EVP_MD_CTX_md EVP_sha1 EVP_MD_block_size EVP_sha512 EVP_MD_CTX_init EC_POINT_new EVP_DigestFinal_ex EVP_CIPHER_CTX_key_length EVP_CIPHER_CTX_new EVP_aes_256_cbc EVP_CIPHER_CTX_iv_length EVP_CipherInit EVP_des_ede3_cbc EVP_aes_192_cbc EVP_CIPHER_CTX_set_key_length EVP_Cipher EVP_CIPHER_CTX_free BN_is_bit_set BN_hex2bn DH_new DH_generate_key RSA_blinding_on BN_dup EC_GROUP_get_order DSA_free BIO_new EC_POINT_cmp ERR_peek_error EC_KEY_set_private_key BN_value_one EVP_PKEY_get1_EC_KEY EC_METHOD_get_field_type EC_POINT_mul RSA_new RSA_free BN_copy ERR_get_error EC_POINT_get_affine_coordinates_GFp ERR_peek_last_error EC_KEY_set_public_key BN_CTX_get EC_KEY_set_group EC_POINT_is_at_infinity BIO_s_mem PEM_read_bio_PrivateKey EC_POINT_free EVP_CIPHER_CTX_set_app_data BN_clear_free EVP_aes_128_cbc BN_CTX_start EVP_PKEY_free EVP_PKEY_get1_RSA EC_GROUP_free DSA_new BIO_write BIO_free EC_GROUP_cmp EVP_PKEY_get1_DSA EC_GROUP_set_asn1_flag EC_GROUP_get_curve_name EC_KEY_get0_private_key BN_CTX_new BN_cmp BN_sub EC_KEY_free EC_GROUP_new_by_curve_name BN_CTX_free EC_GROUP_method_of BN_num_bits OPENSSL_add_all_algorithms_noconf RAND_poll RAND_seed RAND_bytes SSLeay_version ECDH_compute_key EC_KEY_generate_key EC_KEY_get0_public_key BN_new

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter RaiseException GetLastError SetUnhandledExceptionFilter SetLastError

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW RegCloseKey RegCreateKeyExW RegQueryValueExW

ws2_32

WSASend WSARecv GetAddrInfoW WSASocketW WSAIoctl WSADuplicateSocketW WSAGetLastError closesocket getpeername getsockname getsockopt listen setsockopt shutdown socket gethostname bind FreeAddrInfoW ntohs WSAStartup WSACleanup WSAGetOverlappedResult getnameinfo inet_ntoa htonl ntohl htons inet_ntop

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryW GetCurrentDirectoryW GetCommandLineA GetCommandLineW SetEnvironmentVariableW GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle SetStdHandle ExpandEnvironmentStringsW SetEnvironmentVariableA

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle SetHandleInformation

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW TlsSetValue GetCurrentProcess TlsGetValue CreateThread CreateProcessW GetExitCodeProcess TlsFree OpenProcessToken TerminateThread CreateProcessAsUserW GetCurrentProcessId OpenThread GetCurrentThreadId QueueUserAPC TerminateProcess TlsAlloc ExitProcess CreateProcessA

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount SetWaitableTimer EnterCriticalSection WaitForSingleObject CreateEventA DeleteCriticalSection CancelWaitableTimer SleepEx ResetEvent WaitForMultipleObjectsEx SetEvent LeaveCriticalSection

api-ms-win-security-base-l1-1-0

IsValidSid IsValidAcl GetTokenInformation FreeSid CreateRestrictedToken IsValidSecurityDescriptor AllocateLocallyUniqueId AllocateAndInitializeSid AdjustTokenPrivileges EqualSid GetAce IsWellKnownSid

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

samcli

NetUserAdd NetUserGetLocalGroups NetUserGetInfo NetUserGetGroups

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime GetTickCount64 GetSystemDirectoryW GetWindowsDirectoryW GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW FreeLibrary GetProcAddress GetModuleFileNameW GetModuleHandleW GetModuleHandleExW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW LoadLibraryA

api-ms-win-security-lsalookup-ansi-l2-1-0

LookupPrivilegeValueA

userenv

LoadUserProfileW

sspicli

GetUserNameExW LsaDeregisterLogonProcess LsaRegisterLogonProcess LsaLogonUser LsaLookupAuthenticationPackage LsaFreeReturnBuffer

api-ms-win-security-lsalookup-l2-1-1

LsaManageSidNameMapping

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringW MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-file-l1-1-0

FindFirstFileW FindNextFileW FlushFileBuffers CreateFileA FindFirstFileExW GetFileType SetEndOfFile FindClose GetDiskFreeSpaceExW WriteFileEx GetLogicalDriveStringsW ReadFile CreateDirectoryW GetFullPathNameW SetFilePointerEx WriteFile GetFileInformationByHandle ReadFileEx GetFullPathNameA SetFileTime GetFileAttributesExW RemoveDirectoryW SetFileAttributesW DeleteFileW CreateFileW GetDiskFreeSpaceW GetDriveTypeW

api-ms-win-core-debug-l1-1-0

DebugBreak IsDebuggerPresent

crypt32

CryptStringToBinaryA CryptBinaryToStringA

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-synch-l1-2-1

CreateWaitableTimerW WaitForMultipleObjects

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-console-l2-1-0

ScrollConsoleScreenBufferA SetConsoleWindowInfo ReadConsoleOutputA SetConsoleTextAttribute WriteConsoleOutputA SetConsoleScreenBufferSize FillConsoleOutputCharacterA GetConsoleScreenBufferInfo SetConsoleCursorPosition FillConsoleOutputAttribute GetConsoleScreenBufferInfoEx SetConsoleCursorInfo GetLargestConsoleWindowSize FreeConsole GetConsoleCursorInfo

logoncli

NetGetDCName DsGetDcNameW

wkscli

NetWkstaGetInfo

netutils

NetApiBufferFree

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-kernel32-legacy-l1-1-0

CreateNamedPipeA GetComputerNameW SetConsoleTitleA

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler ReadConsoleInputW SetConsoleMode GetConsoleCP ReadConsoleW GetNumberOfConsoleInputEvents PeekConsoleInputA ReadConsoleInputA WriteConsoleW GetConsoleMode WriteConsoleA

api-ms-win-core-synch-ansi-l1-1-0

CreateWaitableTimerA

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-security-sddl-ansi-l1-1-0

ConvertSidToStringSidA ConvertStringSidToSidA

api-ms-win-core-io-l1-1-0

CancelIoEx

api-ms-win-core-util-l1-1-0

Beep

api-ms-win-core-localization-l1-2-0

GetOEMCP GetACP GetCPInfo FormatMessageA IsValidCodePage LCMapStringW

user32

FindWindowA ShowWindow GetWindowPlacement

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTimeZoneInformation

api-ms-win-core-heap-l1-1-0

HeapReAlloc HeapAlloc HeapSize GetProcessHeap HeapFree

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_889e87cf87d69563a6f805c97c3a3e3e_glassworm_icedid_njrat_ryuk

libcrypto

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

ws2_32

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-security-base-l1-1-0

rpcrt4

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

samcli

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-lsalookup-ansi-l2-1-0

userenv

sspicli

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-debug-l1-1-0

crypt32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-console-l2-1-0

logoncli

wkscli

netutils

api-ms-win-security-provider-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-security-sddl-ansi-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-localization-l1-2-0

user32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-datetime-l1-1-0

generic