2026-10-22_afd8be2938517b3cd681d7d93fc032a3_glassworm_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_afd8be2938517b3cd681d7d93fc032a3_glassworm_icedid_njrat_ryuk
Size 2.4MB
Sample261024-ap5dzadh66
SHA256 d75bcd008234a23d0839e42e1af628100df0493d98ce26ec6c5f5732011353a9
MD5 afd8be2938517b3cd681d7d93fc032a3
SHA1 7ad84dff36ce71748e8b4a400383e297639ab873
SHA512 f27d03d50310dd077d69a8377641334ac04640be2702c975710385defad2453ba3a7be6b3c29621b2b057dcd7c0eaba20d80c8ff83cd3fe5f5af4d6ea0ca8919
SSDEEP 24576:CLh1gR6oP7P9j3wLO+3/A6/sEyGKCplM492pTT0H2mJAMBTwbzajcPpFz:CLhFo7JgS+IisEyGKCplKpRawbzajyp
TLSH
T150C5C09AE7B511F4C4B6C0388A632223F9B1B459473497DB86948B5A2F36FF0963F710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_afd8be2938517b3cd681d7d93fc032a3_glassworm_icedid_njrat_ryuk

File Explorer

2026-10-22_afd8be2938517b3cd681d7d93fc032a3_glassworm_icedid_njrat_ryuk

.exe 2.4MB

2026-10-22_afd8be2938517b3cd681d7d93fc032a3_glassworm_icedid_njrat_ryuk

IMPHASH 27de371e1dae125bc04cc09552c72d87
SHA256 d75bcd008234a23d0839e42e1af628100df0493d98ce26ec6c5f5732011353a9
MD5 afd8be2938517b3cd681d7d93fc032a3
SHA1 7ad84dff36ce71748e8b4a400383e297639ab873
SHA512 f27d03d50310dd077d69a8377641334ac04640be2702c975710385defad2453ba3a7be6b3c29621b2b057dcd7c0eaba20d80c8ff83cd3fe5f5af4d6ea0ca8919
SSDEEP 24576:CLh1gR6oP7P9j3wLO+3/A6/sEyGKCplM492pTT0H2mJAMBTwbzajcPpFz:CLhFo7JgS+IisEyGKCplKpRawbzajyp
TLSH
T150C5C09AE7B511F4C4B6C0388A632223F9B1B459473497DB86948B5A2F36FF0963F710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

481216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

sshd.pdb

libcrypto

ECDSA_do_sign ECDSA_SIG_free ECDSA_do_verify ECDSA_SIG_new DH_free EVP_CIPHER_CTX_set_app_data EVP_CIPHER_CTX_get_app_data DH_size DH_compute_key AES_set_encrypt_key DSA_do_sign DSA_do_verify AES_encrypt DSA_SIG_free EC_POINT_oct2point BN_bn2bin EC_POINT_point2oct BN_bin2bn BN_init BN_clear_free RSA_public_decrypt RSA_sign BN_div RSA_size RAND_status SSLeay EVP_sha384 EVP_MD_CTX_copy_ex EVP_MD_CTX_cleanup EVP_md5 EVP_sha256 EVP_DigestUpdate EVP_Digest DSA_SIG_new EVP_DigestInit_ex EVP_MD_CTX_md EVP_sha1 EVP_MD_block_size EVP_sha512 EVP_MD_CTX_init EVP_DigestFinal_ex EVP_CIPHER_CTX_key_length EVP_CIPHER_CTX_new EVP_aes_256_cbc EVP_CIPHER_CTX_iv_length EVP_CipherInit EVP_des_ede3_cbc EVP_aes_192_cbc EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_set_key_length EVP_Cipher EVP_aes_256_gcm EVP_aes_128_gcm EVP_CIPHER_CTX_free BN_is_bit_set BN_hex2bn DH_new DH_generate_key RSA_blinding_on BN_dup EC_GROUP_get_order DSA_free BIO_new EC_POINT_cmp ERR_peek_error EC_KEY_set_private_key BN_value_one EVP_PKEY_get1_EC_KEY EC_METHOD_get_field_type EC_POINT_mul RSA_new RSA_free BN_copy ERR_get_error EC_POINT_get_affine_coordinates_GFp ERR_peek_last_error EC_KEY_set_public_key BN_CTX_get EC_KEY_set_group EC_POINT_is_at_infinity BIO_s_mem PEM_read_bio_PrivateKey EC_POINT_free EVP_aes_128_cbc BN_CTX_start EVP_PKEY_free EVP_PKEY_get1_RSA EC_GROUP_free DSA_new BIO_write BIO_free EC_GROUP_cmp EVP_PKEY_get1_DSA EC_GROUP_set_asn1_flag EC_GROUP_get_curve_name EC_KEY_get0_private_key BN_CTX_new BN_cmp BN_sub EC_GROUP_new_by_curve_name BN_CTX_free EC_GROUP_method_of BN_num_bits OPENSSL_add_all_algorithms_noconf RAND_poll RAND_seed RAND_bytes SSLeay_version ECDH_compute_key EC_KEY_generate_key EC_KEY_get0_public_key EC_KEY_get0_group EC_KEY_free EC_KEY_new_by_curve_name EC_POINT_new EC_GROUP_get_degree BN_new

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetLastError RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter

ws2_32

WSASocketW WSADuplicateSocketW WSAGetLastError htonl ntohl htons WSASend WSARecv WSAIoctl WSAGetOverlappedResult closesocket getpeername inet_ntop inet_ntoa ntohs getsockname getsockopt listen getnameinfo setsockopt shutdown socket gethostname WSAStartup WSACleanup GetAddrInfoW bind FreeAddrInfoW

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableA GetCurrentDirectoryW GetEnvironmentStringsW SetCurrentDirectoryW SetStdHandle GetCommandLineW FreeEnvironmentStringsW GetCommandLineA ExpandEnvironmentStringsW SetEnvironmentVariableW GetEnvironmentVariableW GetStdHandle

api-ms-win-core-handle-l1-1-0

CloseHandle SetHandleInformation DuplicateHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId OpenProcessToken GetExitCodeProcess TerminateProcess GetCurrentProcess CreateProcessA TerminateThread ExitThread CreateThread GetStartupInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetCurrentThreadId OpenThread CreateProcessAsUserW CreateProcessW QueueUserAPC

api-ms-win-core-job-l2-1-0

AssignProcessToJobObject CreateJobObjectW SetInformationJobObject

api-ms-win-core-registry-l1-1-0

RegEnumValueW RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegCloseKey

api-ms-win-security-base-l1-1-0

GetTokenInformation GetSidIdentifierAuthority FreeSid EqualSid DuplicateToken CreateRestrictedToken AllocateLocallyUniqueId AllocateAndInitializeSid AdjustTokenPrivileges CheckTokenMembership CopySid IsWellKnownSid IsValidSecurityDescriptor IsValidAcl GetLengthSid GetAce IsValidSid

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW LookupAccountNameW

api-ms-win-core-kernel32-legacy-l1-1-0

CreateNamedPipeA GetComputerNameW

api-ms-win-core-file-l1-1-0

GetFinalPathNameByHandleW CreateFileA RemoveDirectoryW GetFullPathNameA GetFullPathNameW ReadFile FindClose FindFirstFileExW FindNextFileW DeleteFileW WriteFileEx GetFileType CreateFileW CreateDirectoryW SetFilePointerEx SetEndOfFile GetFileAttributesW FlushFileBuffers ReadFileEx GetFileInformationByHandle GetDriveTypeW WriteFile GetFileAttributesExW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount SleepEx CreateEventA WaitForSingleObjectEx ResetEvent SetWaitableTimer SetEvent WaitForMultipleObjectsEx WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CancelWaitableTimer

api-ms-win-core-file-l2-1-2

CopyFileW

bcrypt

BCryptGenRandom

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

samcli

NetUserGetInfo NetUserAdd

netutils

NetApiBufferFree

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetLocalTime GetSystemDirectoryW GetWindowsDirectoryW GetTickCount64

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW FreeLibrary GetModuleHandleExW GetModuleFileNameW GetModuleHandleW FreeLibraryAndExitThread GetProcAddress

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-console-l2-1-0

FillConsoleOutputAttribute GetConsoleCursorInfo FillConsoleOutputCharacterA SetConsoleScreenBufferSize FreeConsole GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleCursorInfo ScrollConsoleScreenBufferA SetConsoleWindowInfo SetConsoleTextAttribute WriteConsoleOutputA ReadConsoleOutputA

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW

api-ms-win-core-string-l1-1-0

GetStringTypeW MultiByteToWideChar WideCharToMultiByte CompareStringW

api-ms-win-security-lsalookup-ansi-l2-1-0

LookupPrivilegeValueA

userenv

LoadUserProfileW

sspicli

LsaDeregisterLogonProcess LsaConnectUntrusted LsaLookupAuthenticationPackage LsaLogonUser LsaRegisterLogonProcess LsaFreeReturnBuffer

api-ms-win-security-lsalookup-l2-1-1

LsaManageSidNameMapping

api-ms-win-core-debug-l1-1-0

DebugBreak IsDebuggerPresent

crypt32

CryptStringToBinaryA CryptBinaryToStringA

api-ms-win-core-console-l1-1-0

ReadConsoleW SetConsoleCtrlHandler GetConsoleCP GetConsoleMode ReadConsoleInputW SetConsoleMode WriteConsoleW

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-synch-ansi-l1-1-0

CreateWaitableTimerA

api-ms-win-core-io-l1-1-0

CancelIoEx DeviceIoControl

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-core-util-l1-1-0

Beep

api-ms-win-core-localization-l1-2-0

FormatMessageA LCMapStringW GetCPInfo GetOEMCP IsValidCodePage GetACP

api-ms-win-security-sddl-ansi-l1-1-0

ConvertSidToStringSidA

user32

ShowWindow GetWindowPlacement FindWindowA

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTimeZoneInformation

api-ms-win-core-heap-l1-1-0

HeapFree HeapSize HeapAlloc HeapReAlloc GetProcessHeap

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

api-ms-win-eventing-provider-l1-1-0

EventWrite EventRegister

Name

.text

Size

622KB

Virtual Size

622KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

220KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

77KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_afd8be2938517b3cd681d7d93fc032a3_glassworm_icedid_njrat_ryuk

libcrypto

api-ms-win-core-errorhandling-l1-1-0

ws2_32

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-job-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-file-l2-1-2

bcrypt

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

samcli

netutils

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-security-lsalookup-ansi-l2-1-0

userenv

sspicli

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-core-debug-l1-1-0

crypt32

api-ms-win-core-console-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-util-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-security-sddl-ansi-l1-1-0

user32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-eventing-provider-l1-1-0

generic