2026-10-13_fca42f11fa4bf989e0c592f3c368f7c8_glassworm_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_fca42f11fa4bf989e0c592f3c368f7c8_glassworm_icedid_njrat_ryuk
Size 7.4MB
Sample261014-aexalsdy7m
SHA256 cc83ebe8c42fc911940e6ae6c8aab4bf69a5ffd23ebe361577f1c8682fd3d4a9
MD5 fca42f11fa4bf989e0c592f3c368f7c8
SHA1 83eb57fcce6a9f71a742b12f6149c6f1522cb194
SHA512 880390e2dbeec5b20ce476314adc871dc5e2d6e50fc3ed9500912a5003aaa76fd492c44fa623a46aebb19307dc45b49ee28c5ea6e1d87af8ff6f7d8f45d5368f
SSDEEP 98304:3eZoal3DyJZ2IYfUjxmsfdO61BefhKOyPwkZA/9Z01p:VDYqU6vOyPMc1p
TLSH
T198767D13B69A91FCC08BC430D75B47616F7538CA0F35AAEF1058A22A2F799F49E3D614
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-13_fca42f11fa4bf989e0c592f3c368f7c8_glassworm_icedid_njrat_ryuk

File Explorer

2026-10-13_fca42f11fa4bf989e0c592f3c368f7c8_glassworm_icedid_njrat_ryuk

.exe 7.4MB

2026-10-13_fca42f11fa4bf989e0c592f3c368f7c8_glassworm_icedid_njrat_ryuk

IMPHASH 76a2ed6b3a47b9974829075d2ffc8667
SHA256 cc83ebe8c42fc911940e6ae6c8aab4bf69a5ffd23ebe361577f1c8682fd3d4a9
MD5 fca42f11fa4bf989e0c592f3c368f7c8
SHA1 83eb57fcce6a9f71a742b12f6149c6f1522cb194
SHA512 880390e2dbeec5b20ce476314adc871dc5e2d6e50fc3ed9500912a5003aaa76fd492c44fa623a46aebb19307dc45b49ee28c5ea6e1d87af8ff6f7d8f45d5368f
SSDEEP 98304:3eZoal3DyJZ2IYfUjxmsfdO61BefhKOyPwkZA/9Z01p:VDYqU6vOyPMc1p
TLSH
T198767D13B69A91FCC08BC430D75B47616F7538CA0F35AAEF1058A22A2F799F49E3D614
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3786536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

/proc/self/cwd/blaze-out/windows_x64-opt/bin/play/games/battlestar/client/win/client.pdb

advapi32

RegCloseKey RegCreateKeyExW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW

kernel32

AcquireSRWLockExclusive CancelSynchronousIo CloseHandle CompareStringW CreateFileA CreateFileMappingW CreateFileW CreateSemaphoreW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileSize GetFileSizeEx GetFileType GetLastError GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformation GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetPhysicallyInstalledSystemMemory GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GlobalMemoryStatusEx HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetProcessMemoryInfo LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ReleaseSemaphore RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

dbghelp

StackWalk64 SymCleanup SymFromAddr SymFunctionTableAccess64 SymGetModuleBase64 SymInitialize SymSetOptions

shell32

SHGetKnownFolderPath SetCurrentProcessExplicitAppUserModelID ShellExecuteA ShellExecuteW

libcef

cef_api_hash cef_base64encode cef_browser_view_create cef_command_line_create cef_command_line_get_global cef_crash_reporting_enabled cef_create_directory cef_currently_on cef_directory_exists cef_display_get_alls cef_display_get_count cef_display_get_primary cef_execute_process cef_get_min_log_level cef_initialize cef_log cef_post_task cef_process_message_create cef_quit_message_loop cef_run_message_loop cef_set_crash_key_value cef_shared_process_message_builder_create cef_shutdown cef_string_list_alloc cef_string_list_append cef_string_list_free cef_string_list_size cef_string_list_value cef_string_map_alloc cef_string_map_append cef_string_map_free cef_string_map_key cef_string_map_size cef_string_map_value cef_string_multimap_alloc cef_string_multimap_append cef_string_multimap_free cef_string_multimap_key cef_string_multimap_size cef_string_multimap_value cef_string_userfree_utf16_free cef_string_utf16_clear cef_string_utf16_cmp cef_string_utf16_set cef_string_utf16_to_utf8 cef_string_utf8_clear cef_string_utf8_to_utf16 cef_string_wide_to_utf8 cef_uriencode cef_v8context_get_current_context cef_v8value_create_bool cef_v8value_create_function cef_v8value_create_int cef_v8value_create_string cef_window_create_top_level

user32

AllowSetForegroundWindow GetSystemMetrics LoadImageW SendMessageW SetForegroundWindow UnregisterClassW

ole32

CoTaskMemFree

wininet

HttpAddRequestHeadersA HttpOpenRequestA HttpQueryInfoA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetReadFile InternetSetOptionA

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

249KB

Virtual Size

373KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

221KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

409B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

flags_he

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

1024B

Virtual Size

663B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

protodes

Size

496KB

Virtual Size

495KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

140KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

628KB

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_fca42f11fa4bf989e0c592f3c368f7c8_glassworm_icedid_njrat_ryuk

advapi32

kernel32

dbghelp

shell32

libcef

user32

ole32

wininet

bcrypt

generic