2026-10-29_17a3537d08350686f4cca63739d027ec_blankgrabber_glassworm_icedid_luca-stealer_njrat

General

Target
2026-10-29_17a3537d08350686f4cca63739d027ec_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 36.5MB
Sample261029-vglbcaev8l
SHA256 75a8f88a15f43fada66bc7c4ec2261f048bb6c0207646110d2c0f760e758da6b
MD5 17a3537d08350686f4cca63739d027ec
SHA1 ca06d0890ef03547dfe9c6ccaabdf6df91ba0ed9
SHA512 6809ecc8fe539643fe163b3cf760c04bad7a852e44140e6f87830d4bd84f61953b09432918eab982730802127dd4c31fbc353ce3de7cee519bdfcf6a213fc5ab
SSDEEP 393216:SGrYJr0goM1T5GB2b3rOfOM/YMe1D1KcW:SbrbDZkV2M/Je1D1Kl
TLSH
T1F7872A0222948061E9E1D7BD7D16938BDAB17816371326E730AEC89C7F539A257FF18C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-29_17a3537d08350686f4cca63739d027ec_blankgrabber_glassworm_icedid_luca-stealer_njrat

File Explorer

2026-10-29_17a3537d08350686f4cca63739d027ec_blankgrabber_glassworm_icedid_luca-stealer_njrat

.exe 36.5MB

2026-10-29_17a3537d08350686f4cca63739d027ec_blankgrabber_glassworm_icedid_luca-stealer_njrat

IMPHASH 6b99df3882406b72811611fc5b5eeafa
SHA256 75a8f88a15f43fada66bc7c4ec2261f048bb6c0207646110d2c0f760e758da6b
MD5 17a3537d08350686f4cca63739d027ec
SHA1 ca06d0890ef03547dfe9c6ccaabdf6df91ba0ed9
SHA512 6809ecc8fe539643fe163b3cf760c04bad7a852e44140e6f87830d4bd84f61953b09432918eab982730802127dd4c31fbc353ce3de7cee519bdfcf6a213fc5ab
SSDEEP 393216:SGrYJr0goM1T5GB2b3rOfOM/YMe1D1KcW:SbrbDZkV2M/Je1D1Kl
TLSH
T1F7872A0222948061E9E1D7BD7D16938BDAB17816371326E730AEC89C7F539A257FF18C
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

23672408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

python312

_Py_NotImplementedStruct PyExc_SyntaxError PyExc_BlockingIOError PyExc_ZeroDivisionError PyRange_Type PyNumber_Positive PyExc_EOFError PyFrozenSet_New PyExc_PermissionError PyExc_ProcessLookupError PyExc_ChildProcessError PyExc_InterruptedError PyExc_IOError PyStatus_Exception PyWideStringList_Append PyConfig_SetString PyConfig_SetArgv PyThreadState_Get PyLong_AsLong PyList_Size PyList_SetSlice PyDict_DelItemString Py_SetProgramName Py_InitializeFromConfig Py_ExitStatusException PySys_SetArgv _PyWarnings_Init _PyRuntime_Initialize _PyConfig_InitCompatConfig Py_DebugFlag Py_VerboseFlag Py_InteractiveFlag Py_InspectFlag Py_OptimizeFlag Py_NoSiteFlag Py_BytesWarningFlag Py_FrozenFlag Py_IgnoreEnvironmentFlag Py_DontWriteBytecodeFlag Py_NoUserSiteDirectory Py_UTF8Mode PyImport_FrozenModules PyMem_Malloc PyMem_Free PyMem_GetAllocator PyType_Ready PyObject_Str PyObject_RichCompare PyObject_RichCompareBool PyObject_SetAttrString PyObject_SelfIter PyObject_GenericSetAttr PyObject_IsTrue PyCallable_Check PyObject_ClearWeakRefs _Py_Dealloc PyObject_Realloc PyObject_Free PyObject_Init _PyObject_New _PyObject_GC_Resize PyObject_GC_Del PyByteArray_FromStringAndSize PyBytes_FromString PyBytes_AsString PyUnicode_FromStringAndSize PyUnicode_FromEncodedObject PyUnicode_InternInPlace PyUnicode_FromWideChar PyUnicode_AsWideCharString PyUnicode_FromOrdinal PyUnicode_DecodeUTF8 PyUnicode_Concat PyUnicode_FindChar PyUnicode_Format PyUnicode_New PyUnicode_AsUTF8 PyErr_ExceptionMatches PyErr_BadArgument PyErr_NoMemory PyErr_SetFromErrno PyOS_snprintf _PyErr_WriteUnraisableMsg PyLong_AsLongAndOverflow PyLong_AsSsize_t PyLong_FromString PyMemoryView_Type _PyLong_New _PyLong_Copy PyFloat_FromString PyFloat_FromDouble PyComplex_FromDoubles PyTuple_New _PyTuple_MaybeUntrack PyList_New PyList_Append PyList_Sort PyDict_New PyDict_GetItem PyDict_GetItemString PyDict_SetItemString _PyDict_MaybeUntrack _PySet_NextEntry PyCMethod_New PyModule_NewObject PyModule_GetName PyModule_GetFilenameObject PyModule_GetDef PyModule_GetState PyUnstable_Code_NewWithPosOnlyArgs PyErr_WarnEx _PyWeakref_ClearRef PyArg_ParseTuple PyArg_ParseTupleAndKeywords PyArg_UnpackTuple Py_BuildValue PyModule_ExecDef PyModule_FromDefAndSpec2 _PyArg_NoKeywords PyErr_Print Py_CompileStringExFlags PyEval_EvalCodeEx PyEval_GetFuncName PyEval_RestoreThread _PyEval_EvalFrameDefault PySys_WriteStderr PyImport_ExecCodeModule PyImport_ExecCodeModuleEx PyImport_GetModuleDict PyImport_ImportModule PyImport_ImportFrozenModule _PyImport_FixupExtensionObject PyObject_Call PyObject_CallFunction PyObject_CallFunctionObjArgs PyObject_CallMethodObjArgs PyObject_GetIter PyIter_Next PyIter_Send PyNumber_Add PyNumber_Subtract PyNumber_FloorDivide PyNumber_Float PyNumber_InPlaceAdd PyNumber_InPlaceLshift PyNumber_InPlaceOr PyNumber_ToBase PySequence_List PySequence_InPlaceConcat PyMapping_Check PyObject_LengthHint PyMarshal_ReadObjectFromString _PyErr_ChainStackItem _PyErr_NormalizeException _PyByteArray_empty_string PyExc_StopAsyncIteration PyExc_UnboundLocalError PyExc_ImportWarning PyDictKeys_Type PyDictValues_Type PyDictItems_Type PyModuleDef_Type PyFunction_Type PyMethod_Type PyCode_Type PyFrame_Type PyTraceBack_Type PyEllipsis_Type PyCallIter_Type PyGen_Type PyCoro_Type PyAsyncGen_Type _PyAsyncGenWrappedValue_Type Py_GenericAliasType _PyWeakref_RefType _PyWeakref_ProxyType _PyWeakref_CallableProxyType _PyRuntime PyExc_OverflowError PyFloat_Type PyExc_ModuleNotFoundError PyByteArray_FromObject PyFrozenSet_Type PySet_Type PyComplex_Type PySlice_Type PyExc_UnicodeEncodeError PyExc_UnicodeError PyExc_FileNotFoundError PyExc_NameError PyExc_MemoryError PyExc_KeyboardInterrupt PyObject_SetAttr PyNumber_Invert PyObject_Dir PyDict_MergeFromSeq2 PyDict_Merge PyObject_GetAttr PyEnum_Type PyExc_NotImplementedError PyLong_FromVoidPtr _Py_EllipsisObject PyReversed_Type PyExc_WindowsError PyExc_RuntimeError PyObject_Repr PyNumber_Negative PyBytes_Type PyProperty_Type PySet_Add PyByteArray_Type PyFilter_Type PyZip_Type PyExc_OSError PyExc_UnicodeDecodeError PyExc_LookupError PyMap_Type PyBool_Type PyLong_Type PyObject_GetItem _PyDict_NewPresized PyExc_GeneratorExit PyExc_BaseException PyObject_IsSubclass PyObject_DelItem PyDict_DelItem PyErr_WriteUnraisable PyNumber_Long PyDict_Type PyTuple_Type PyExc_ValueError PyExc_SystemExit PySequence_Tuple PyDict_Update PyUnicode_FromFormat _PyObject_FunctionStr PyExc_KeyError PyExc_ImportError PySequence_Contains Py_Exit PySet_Contains PySet_New PyUnicode_Join PySeqIter_Type PyModule_Type PyList_Type PyExc_IndexError PyExc_AssertionError PyExc_StopIteration PyExc_Exception PyUnicode_Type _PyThreadState_GetCurrent PySequence_Check PyNumber_AsSsize_t PyObject_SetItem PyEval_AcquireThread PyEval_SaveThread Py_MakePendingCalls PyErr_PrintEx Py_GenericAlias PyModule_GetDict PyDict_SetItem PyLong_FromSsize_t PyObject_GetAttrString PyType_IsSubtype PyCFunction_Type PyExc_TypeError PyExc_SystemError PyExc_AttributeError _Py_NoneStruct PyBaseObject_Type PyType_Type PyObject_IsInstance PyErr_Format _PyType_Lookup _Py_TrueStruct _Py_FalseStruct PySys_SetObject PySys_GetObject PyStructSequence_New PyStructSequence_InitType PyCapsule_New PyUnicode_Find PyUnicode_GetLength PyUnicode_Substring PyUnicode_FromString PyLong_FromUnicodeObject

kernel32

WriteConsoleW HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose MultiByteToWideChar GetStringTypeW GetFileType LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetStdHandle SetConsoleCtrlHandler GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess RtlPcToFileHeader RaiseException EncodePointer FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError RtlUnwindEx GetModuleHandleA GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentThreadId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WideCharToMultiByte FindResourceA FormatMessageA LockResource LoadResource LoadLibraryExW GetModuleFileNameW GetSystemTimeAsFileTime GetCurrentProcessId SetErrorMode GetLastError CloseHandle WriteFile GetShortPathNameW CreateFileW SetEnvironmentVariableW GetEnvironmentVariableW SetDllDirectoryW GetProcAddress SetStdHandle

Name

.text

Size

22.7MB

Virtual Size

22.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

341KB

Virtual Size

340KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

68KB

Virtual Size

904KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

250KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13.1MB

Virtual Size

13.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-29_17a3537d08350686f4cca63739d027ec_blankgrabber_glassworm_icedid_luca-stealer_njrat

python312

kernel32

generic