2026-10-22_ee3b10402555c604bf2ee78358ac565e_blankgrabber_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_ee3b10402555c604bf2ee78358ac565e_blankgrabber_glassworm_icedid_njrat
Size 9.6MB
Sample261023-d27lmswtes
SHA256 546471c925b68eed2addf4a96613ff0b4190917d26e9596865e3bd69b9b152d4
MD5 ee3b10402555c604bf2ee78358ac565e
SHA1 c18494c9990a729536dda75c38f7996ac86c8261
SHA512 54125ca37c2bbc245324388c0f50728d0a9b1a92167172a71a4020cb0024523a468fef6450ffe72485631ecb36a10a4d936c4ec564e055ef727d45d1f62cd0c4
SSDEEP 98304:Q66Gh1EFY3krE9JrwA6iJBFJfmcoj2XUQZBi9SBdQLPaG/M8VDAQ8:OGhCFaxX7kcoju7ZBisLQLPH/M8xA7
TLSH
T1EBA67C53E3F650DAD576C0358A12B223BDF178458338A3EBD7D19E4A5B21BE08A3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_ee3b10402555c604bf2ee78358ac565e_blankgrabber_glassworm_icedid_njrat

File Explorer

2026-10-22_ee3b10402555c604bf2ee78358ac565e_blankgrabber_glassworm_icedid_njrat

.exe 9.6MB

2026-10-22_ee3b10402555c604bf2ee78358ac565e_blankgrabber_glassworm_icedid_njrat

IMPHASH 259e1b87291aff4c06627ced87a30888
SHA256 546471c925b68eed2addf4a96613ff0b4190917d26e9596865e3bd69b9b152d4
MD5 ee3b10402555c604bf2ee78358ac565e
SHA1 c18494c9990a729536dda75c38f7996ac86c8261
SHA512 54125ca37c2bbc245324388c0f50728d0a9b1a92167172a71a4020cb0024523a468fef6450ffe72485631ecb36a10a4d936c4ec564e055ef727d45d1f62cd0c4
SSDEEP 98304:Q66Gh1EFY3krE9JrwA6iJBFJfmcoj2XUQZBi9SBdQLPaG/M8VDAQ8:OGhCFaxX7kcoju7ZBisLQLPH/M8xA7
TLSH
T1EBA67C53E3F650DAD576C0358A12B223BDF178458338A3EBD7D19E4A5B21BE08A3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4077312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\Users\admin\Desktop\dev\cpp\prime\wardogs\x64\Debug Optimized\svchost.pdb

kernel32

InitOnceBeginInitialize GetModuleHandleW GetCurrentThreadId WaitForSingleObject ResetEvent GetLastError SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA SetEndOfFile SetStdHandle GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation FlushFileBuffers HeapQueryInformation DeleteFileW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect OutputDebugStringW CreateEventA CloseHandle VerSetConditionMask LoadLibraryA MultiByteToWideChar GetModuleHandleA GetProcAddress UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetConsoleOutputCP ReadConsoleW GetConsoleMode SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW ExitProcess IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread GetSystemInfo HeapValidate HeapSize WriteConsoleW FreeLibrary LoadLibraryExA GetModuleHandleExW TerminateProcess GetCurrentProcess RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc LoadLibraryExW GetModuleFileNameW RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry VirtualQuery InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter RaiseException IsDebuggerPresent CreateFileW VerifyVersionInfoW SleepEx WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle GetEnvironmentVariableA FormatMessageW SetLastError LoadLibraryW GetSystemDirectoryW GetTickCount WriteFile GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer K32GetDeviceDriverFileNameA K32GetDeviceDriverBaseNameA K32EnumDeviceDrivers SetThreadGroupAffinity GetActiveProcessorCount GetActiveProcessorGroupCount GetCurrentThread GetThreadGroupAffinity Sleep GetCurrentProcessId WideCharToMultiByte FindClose FindNextFileA FindFirstFileA QueryPerformanceFrequency QueryPerformanceCounter GetTickCount64 CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW WaitForSingleObjectEx GetExitCodeThread GetSystemTimePreciseAsFileTime GetCurrentDirectoryW CreateDirectoryW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW CreateFile2 AreFileApisANSI MoveFileExW GetFileInformationByHandleEx LocalFree GetLocaleInfoEx ReleaseSRWLockShared AcquireSRWLockShared EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection InitOnceComplete

user32

IsWindow GetWindowThreadProcessId AttachThreadInput SetForegroundWindow SetFocus DrawIconEx LoadCursorW FindWindowW RegisterClassW CreateWindowExW GetSystemMetrics PeekMessageW TranslateMessage DispatchMessageW GetClassNameW CallNextHookEx EnumWindows ToUnicodeEx DefWindowProcW GetKeyState LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode GetKeyboardLayout SetKeyboardState SendMessageTimeoutW GetAsyncKeyState GetCursorPos SetCursorPos ReleaseCapture GetKeyboardState

gdi32

CreateCompatibleDC DeleteDC SelectObject DeleteObject CreateDIBSection

shell32

SHGetFolderPathA

bcrypt

BCryptGenRandom

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlAdjustPrivilege

d3dcompiler_47

D3DCompile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ws2_32

getsockopt WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent gethostname setsockopt WSAWaitForMultipleEvents WSAGetLastError __WSAFDIsSet WSASetLastError ntohs inet_ntop WSAStartup WSASetEvent WSACleanup accept closesocket recv send socket WSAIoctl htons inet_pton bind connect getsockname htonl listen getaddrinfo freeaddrinfo ntohl recvfrom sendto getpeername ioctlsocket select

crypt32

CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW CertEnumCertificatesInStore CertCloseStore PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertOpenStore

advapi32

CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW CryptEncrypt

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_ee3b10402555c604bf2ee78358ac565e_blankgrabber_glassworm_icedid_njrat

kernel32

user32

gdi32

shell32

bcrypt

d3dx11_43

dxgi

d3d11

dcomp

dwmapi

ntdll

d3dcompiler_47

api-ms-win-core-synch-l1-2-0

ws2_32

crypt32

advapi32

generic