2026-10-08_212bcc91f4f61d078d7530ca87b52956_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc[.]exe[.]mei

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-08_212bcc91f4f61d078d7530ca87b52956_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe.mei
Size 4.4MB
Sample261017-aap1qscb83
SHA256 d4e8c4a7cdcdca624a040b53382f6b7e8fb881a080054ea77db0528135659e5a
MD5 212bcc91f4f61d078d7530ca87b52956
SHA1 66f271dd278abc824f10c6698450fe8c7d010359
SHA512 bb439da5a3e691c31a41aad25668878e75a05fba3084d2d8881fe4411f5a244b3134ae982987b15402436fc3840c9fdf534157b3069dd4f0b1313329e97b5d68
SSDEEP 98304:PG1G5cgk3zZXWkkJ/hK2XPb+V8EzmBmhzA2ZpXGPsXmn:gG5chzZXWkkJ/hK2jQFmBmhzA2ZpXGkM
TLSH
T11F26AE46B3A801B8C177C178CA569607E7B27848136197DF13E0A6B92F737E16B3E352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-08_212bcc91f4f61d078d7530ca87b52956_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe.mei

File Explorer

2026-10-08_212bcc91f4f61d078d7530ca87b52956_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe.mei

.exe 4.4MB

2026-10-08_212bcc91f4f61d078d7530ca87b52956_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe.mei

IMPHASH dbc0cbbf0fa81aa19a451edfc3325002
SHA256 d4e8c4a7cdcdca624a040b53382f6b7e8fb881a080054ea77db0528135659e5a
MD5 212bcc91f4f61d078d7530ca87b52956
SHA1 66f271dd278abc824f10c6698450fe8c7d010359
SHA512 bb439da5a3e691c31a41aad25668878e75a05fba3084d2d8881fe4411f5a244b3134ae982987b15402436fc3840c9fdf534157b3069dd4f0b1313329e97b5d68
SSDEEP 98304:PG1G5cgk3zZXWkkJ/hK2XPb+V8EzmBmhzA2ZpXGPsXmn:gG5chzZXWkkJ/hK2jQFmBmhzA2ZpXGkM
TLSH
T11F26AE46B3A801B8C177C178CA569607E7B27848136197DF13E0A6B92F737E16B3E352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1775208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

ws2_32

WSAEventSelect WSAResetEvent WSAEnumNetworkEvents ntohl inet_pton inet_ntop socket ntohs WSAStartup WSACloseEvent send getsockopt WSAWaitForMultipleEvents closesocket WSACleanup WSAGetLastError accept htons WSACreateEvent gethostname bind ioctlsocket connect sendto recvfrom freeaddrinfo getaddrinfo listen htonl select __WSAFDIsSet WSAIoctl WSASetLastError setsockopt recv getsockname getpeername

iphlpapi

if_nametoindex

crypt32

CertFreeCRLContext CertAddCertificateContextToStore CertFreeCTLContext CertFindExtension CertFreeCertificateChain CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CryptDecodeObjectEx CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CertGetCertificateChain CertFreeCertificateChainEngine

secur32

InitSecurityInterfaceW

kernel32

WaitForSingleObject CreateFileW GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetExitCodeThread Sleep GetLastError GetFileAttributesExW Process32NextW CreateFileA GetCurrentThread GetSystemDirectoryA DeleteFileA DeleteFileW Process32FirstW CloseHandle Module32FirstW DecodePointer GetThreadContext GetProcAddress VirtualAllocEx DeleteCriticalSection WideCharToMultiByte CreateRemoteThread Module32NextW QueryFullProcessImageNameW VirtualFreeEx IsDebuggerPresent CheckRemoteDebuggerPresent CreateProcessW GetModuleFileNameW RemoveVectoredExceptionHandler GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetSystemInfo IsDBCSLeadByte VerSetConditionMask FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection SleepEx GetTickCount GetFullPathNameW MoveFileExW WaitForSingleObjectEx CreateThread GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW FormatMessageW GetFileSizeEx LocalFree GetTickCount64 GetFileAttributesA AddVectoredExceptionHandler InitializeCriticalSectionEx HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap ExitProcess GetCurrentThreadId GetSystemDirectoryW VirtualProtect VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA AddDllDirectory SetDefaultDllDirectories SetDllDirectoryW InitializeCriticalSection VirtualAlloc LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx OutputDebugStringW OutputDebugStringA GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetSystemTimeAsFileTime GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFileInformationByHandle HeapDestroy RtlUnwind ExitThread FreeLibraryAndExitThread GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetConsoleMode ReadConsoleW GetConsoleOutputCP SetFilePointerEx WriteConsoleW DuplicateHandle FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale TerminateProcess GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers SetStdHandle FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx WakeAllConditionVariable SleepConditionVariableSRW TryAcquireSRWLockExclusive FormatMessageA InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent RaiseException RtlPcToFileHeader SetEndOfFile GetExitCodeProcess CreatePipe WriteFile GetTimeZoneInformation IsValidCodePage GetACP GetCurrentProcess SetLastError WriteProcessMemory InitializeSListHead GetModuleHandleW GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCurrentProcessId

user32

RegisterClassExW UnregisterClassW GetSystemMetrics SendMessageW CreateWindowExW DestroyWindow DefWindowProcW GetCursorPos LoadIconW PostQuitMessage SetWindowPos ShowWindow PostMessageW SetCursorPos ReleaseCapture GetClientRect DispatchMessageW PeekMessageW SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout SetLayeredWindowAttributes UpdateWindow GetWindowRect TranslateMessage IsWindowUnicode TrackMouseEvent MessageBoxA OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen

advapi32

CryptHashData RegCreateKeyExA RegQueryValueExA RegCloseKey CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptCreateHash CryptAcquireContextW CryptDestroyKey CryptImportKey CryptEncrypt RegOpenKeyExA OpenProcessToken SystemFunction036 ConvertSidToStringSidA CopySid SetSecurityInfo RegDeleteKeyA IsValidSid InitializeAcl GetTokenInformation GetLengthSid AddAccessAllowedAce RegSetValueExA

shell32

ShellExecuteW SHCreateDirectoryExW SHGetKnownFolderPath ShellExecuteA

ole32

CoTaskMemFree CoInitializeEx CoCreateInstance CoUninitialize

shlwapi

PathFindFileNameW

wininet

InternetCloseHandle HttpSendRequestW InternetReadFile HttpOpenRequestW InternetOpenW InternetSetOptionW HttpQueryInfoW InternetConnectW

psapi

GetModuleInformation

urlmon

URLDownloadToFileW

bcrypt

BCryptCreateHash BCryptHashData BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDestroyHash

d3dcompiler_47

D3DCompile

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

wintrust

WinVerifyTrust

dnsapi

DnsFree DnsQuery_A

userenv

UnloadUserProfile

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

811KB

Virtual Size

811KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_212bcc91f4f61d078d7530ca87b52956_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe.mei

d3d11

dwmapi

ws2_32

iphlpapi

crypt32

secur32

kernel32

user32

advapi32

shell32

ole32

shlwapi

wininet

psapi

urlmon

bcrypt

d3dcompiler_47

imm32

wintrust

dnsapi

userenv

generic