2026-10-19_50655c2c04510e8d765db78b28cf0b64_blankgrabber_glassworm_icedid_njrat_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_50655c2c04510e8d765db78b28cf0b64_blankgrabber_glassworm_icedid_njrat_ryuk_stealc
Size 7.5MB
Sample261020-zhdp4sdb68
SHA256 c6716b20621c408580dd02cd8be67ae8885fcc533546157396adcd556169c59d
MD5 50655c2c04510e8d765db78b28cf0b64
SHA1 c40c1158a6a52682d8d789a5c1169e8a61e21e57
SHA512 398bb1edf310cb43c31ec6d610764a5c718f5244912941c738cebdfdffb6eed4eb54ee0b79808af10bfd62f1e48557ad5efd664aee42aaf54ff6a30098dd161a
SSDEEP 98304:l6EHWpkhbwlqTknZpY9b5ruFfenihQCkJnxs/R:lanZ65VCkJnxs/
TLSH
T17F863903F25991EAC89DC0B9635BA23BAA657C0D07347ACF4BC05B212E56FE19B3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_50655c2c04510e8d765db78b28cf0b64_blankgrabber_glassworm_icedid_njrat_ryuk_stealc

File Explorer

2026-10-19_50655c2c04510e8d765db78b28cf0b64_blankgrabber_glassworm_icedid_njrat_ryuk_stealc

.exe 7.5MB

2026-10-19_50655c2c04510e8d765db78b28cf0b64_blankgrabber_glassworm_icedid_njrat_ryuk_stealc

IMPHASH d7af081a3a9677f05280c0bc494e65b8
SHA256 c6716b20621c408580dd02cd8be67ae8885fcc533546157396adcd556169c59d
MD5 50655c2c04510e8d765db78b28cf0b64
SHA1 c40c1158a6a52682d8d789a5c1169e8a61e21e57
SHA512 398bb1edf310cb43c31ec6d610764a5c718f5244912941c738cebdfdffb6eed4eb54ee0b79808af10bfd62f1e48557ad5efd664aee42aaf54ff6a30098dd161a
SSDEEP 98304:l6EHWpkhbwlqTknZpY9b5ruFfenihQCkJnxs/R:lanZ65VCkJnxs/
TLSH
T17F863903F25991EAC89DC0B9635BA23BAA657C0D07347ACF4BC05B212E56FE19B3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3008072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CompareStringW CreateDirectoryW CreateFileMappingW CreateFileW CreateJobObjectW CreateProcessW CreateThread DecodePointer DeleteCriticalSection DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetLargePageMinimum GetLastError GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformationEx GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessAffinityMask GetProcessGroupAffinity GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVolumePathNameW HeapQueryInformation HeapReAlloc HeapSize HeapValidate HeapWalk InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetProcessMemoryInfo LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LocalFree MapViewOfFile MultiByteToWideChar OpenSemaphoreA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSRWLockExclusive ReleaseSemaphore ResumeThread SearchPathW SetConsoleCtrlHandler SetConsoleTextAttribute SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFilePointerEx SetFileTime SetInformationJobObject SetLastError SetProcessAffinityMask SetStdHandle SetThreadGroupAffinity SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

ntdll

RtlCaptureContext RtlGetLastNtStatus RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind

advapi32

AdjustTokenPrivileges CryptAcquireContextW CryptGenRandom CryptReleaseContext LookupPrivilegeValueW OpenProcessToken RegCloseKey RegGetValueW RegOpenKeyExA

Name

.text

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

57B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_50655c2c04510e8d765db78b28cf0b64_blankgrabber_glassworm_icedid_njrat_ryuk_stealc

kernel32

ntdll

advapi32

generic