2026-11-01_ff4ac989a1ff3c2c0433860ccdeea66f_blankgrabber_coinminer_glassworm_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_ff4ac989a1ff3c2c0433860ccdeea66f_blankgrabber_coinminer_glassworm_icedid_njrat
Size 27.5MB
Sample261102-bph2eagv2j
SHA256 f31e18dec197962e459b182f963ccaba7f44bf0112c23d5500c5e18f9bc79191
MD5 ff4ac989a1ff3c2c0433860ccdeea66f
SHA1 b99a5145e658af622d93b117c53c0e5cc09fa005
SHA512 d5dc5ad45e6b06356bee82f7dee2b7877589ec5a907b0b05dcfa82fb50f9c02b9de6924e11e5fb7cb6b865e70a876475dae1c6a51e540f57ed5d75f90405430b
SSDEEP 393216:v+cFc0IEIHr+eagu2oWfHxJXtBoHvKvdQ75vEKTBL95rty:vYEyix6kCu
TLSH
T1F5579E1772E801ECE0BAD17DCA9B8907EBB2B819037157DF069085AA1F27AF44E7D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_ff4ac989a1ff3c2c0433860ccdeea66f_blankgrabber_coinminer_glassworm_icedid_njrat

File Explorer

2026-11-01_ff4ac989a1ff3c2c0433860ccdeea66f_blankgrabber_coinminer_glassworm_icedid_njrat

.exe 27.5MB

2026-11-01_ff4ac989a1ff3c2c0433860ccdeea66f_blankgrabber_coinminer_glassworm_icedid_njrat

IMPHASH 21ca3d973be87c79fcd1a94c36df90ec
SHA256 f31e18dec197962e459b182f963ccaba7f44bf0112c23d5500c5e18f9bc79191
MD5 ff4ac989a1ff3c2c0433860ccdeea66f
SHA1 b99a5145e658af622d93b117c53c0e5cc09fa005
SHA512 d5dc5ad45e6b06356bee82f7dee2b7877589ec5a907b0b05dcfa82fb50f9c02b9de6924e11e5fb7cb6b865e70a876475dae1c6a51e540f57ed5d75f90405430b
SSDEEP 393216:v+cFc0IEIHr+eagu2oWfHxJXtBoHvKvdQ75vEKTBL95rty:vYEyix6kCu
TLSH
T1F5579E1772E801ECE0BAD17DCA9B8907EBB2B819037157DF069085AA1F27AF44E7D711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18286160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\WS\tv_prel_dcr\build_cmake_win64\FULL\Release\TeamViewer_Service.pdb

dbghelp

SymFromAddr SymSetOptions SymGetOptions SymInitialize

kernel32

DeviceIoControl CreateNamedPipeW TransactNamedPipe RemoveVectoredExceptionHandler GetCurrentThreadId GetModuleFileNameW LoadLibraryExA GetModuleHandleA GetModuleFileNameA GetSystemDirectoryA GetLastError lstrcmpiW DeleteCriticalSection RaiseException DecodePointer LeaveCriticalSection EnterCriticalSection FreeLibrary GetProcAddress GetModuleHandleW MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW InitializeCriticalSectionEx TryAcquireSRWLockExclusive WaitForMultipleObjects WaitForSingleObject PostQueuedCompletionStatus FormatMessageW ReleaseSRWLockExclusive SetEvent AcquireSRWLockExclusive TerminateThread CloseHandle QueueUserAPC LocalFree WideCharToMultiByte FormatMessageA CreateEventA CreateDirectoryW CreateThread GetCurrentThread SetLastError MoveFileExW GetTempPathW ExpandEnvironmentStringsW CreateEventW GetUserGeoID GetGeoInfoW GetLocaleInfoW GlobalMemoryStatusEx GetComputerNameW DeleteFileW MoveFileW GetSystemTimeAsFileTime GetUserDefaultLCID LCMapStringA GetStringTypeExA LoadLibraryA SetUnhandledExceptionFilter GetCurrentProcessId GetCurrentProcess FindFirstFileW FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FindClose LoadLibraryW CreateFileW CreateProcessW GetSystemDirectoryW WriteFile HeapFree HeapSize HeapReAlloc HeapAlloc HeapDestroy GetProcessHeap GetTempFileNameW InitializeSRWLock SetWaitableTimer GetQueuedCompletionStatus SleepEx CreateIoCompletionPort CreateWaitableTimerW GetSystemDefaultUILanguage GetUserDefaultUILanguage LCIDToLocaleName GetProcessId ProcessIdToSessionId OpenEventW GetNativeSystemInfo GetSystemPowerStatus ResetEvent GetProcessHeaps K32GetProcessMemoryInfo K32GetPerformanceInfo GetProcessTimes GetSystemTime SystemTimeToFileTime GetProcessHandleCount OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW UnregisterWaitEx WaitNamedPipeW ReadFile ResumeThread TerminateProcess QueryFullProcessImageNameW K32GetModuleFileNameExW K32EnumProcesses RegisterWaitForSingleObject GetExitCodeProcess GetSystemInfo VerSetConditionMask VerifyVersionInfoW CreatePipe SetHandleInformation WaitForSingleObjectEx DuplicateHandle CreateSemaphoreA ReleaseSemaphore QueryPerformanceCounter QueryPerformanceFrequency SetSearchPathMode SetDllDirectoryW HeapSetInformation SetProcessDEPPolicy GetFileAttributesW GetPrivateProfileStringW GetFileInformationByHandle GetFileType GetStdHandle ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree Sleep VirtualAlloc VirtualProtect VirtualFree RtlVirtualUnwind GetModuleHandleExW GetEnvironmentVariableW GetACP InitializeCriticalSection TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS GetExitCodeThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW CreateFileA SetNamedPipeHandleState GetOverlappedResult CancelIoEx WaitNamedPipeA RtlUnwind OpenThread GetTickCount GetComputerNameExA GetComputerNameExW GetVersionExW GlobalAlloc GlobalFree OpenMutexW CreateFileMappingA OpenFileMappingA UnmapViewOfFile ReleaseMutex SwitchToThread MapViewOfFileEx CreateMutexW InitOnceExecuteOnce RemoveDirectoryW GetTickCount64 GetThreadId VirtualQuery Module32FirstW Module32NextW RtlCaptureStackBackTrace SetFileAttributesW FlushFileBuffers MapViewOfFile CreateFileMappingW GetFileSize LockFileEx UnlockFile HeapCompact DeleteFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI K32EnumProcessModules GetSystemFirmwareTable LCMapStringW GetStringTypeExW GetVolumeInformationW WTSGetActiveConsoleSessionId GetEnvironmentVariableA GetFileSizeEx GetCurrentDirectoryW LocalFileTimeToFileTime SetFileTime GetPrivateProfileIntW GetPrivateProfileSectionW WritePrivateProfileStringW LocalAlloc GetActiveProcessorCount GetActiveProcessorGroupCount GetCurrentProcessorNumberEx SetThreadGroupAffinity GetDynamicTimeZoneInformation GetTimeZoneInformation GetTimeFormatW GetDateFormatW GetLocalTime SleepConditionVariableSRW GetLogicalProcessorInformation GetThreadTimes GetVersion IsDebuggerPresent TryAcquireSRWLockShared GetStringTypeW GetLocaleInfoEx FindFirstFileExW GetFinalPathNameByHandleW SetFileInformationByHandle GetFileInformationByHandleEx InitOnceBeginInitialize InitOnceComplete RtlPcToFileHeader EncodePointer LCMapStringEx CompareStringEx GetCPInfo GetFileTime SetFilePointerEx GetWindowsDirectoryW CopyFileExW WaitForMultipleObjectsEx OpenEventA CreateWaitableTimerA RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW AddVectoredExceptionHandler GetSystemTimes Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection RtlUnwindEx InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount SetConsoleCtrlHandler ExitThread FreeLibraryAndExitThread SetStdHandle ExitProcess GetDriveTypeW PeekNamedPipe SetEnvironmentVariableW GetConsoleOutputCP GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW IsValidLocale EnumSystemLocalesW HeapQueryInformation IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GetBinaryTypeW

api-ms-win-devices-query-l1-1-0

DevCreateObjectQuery

srvcli

NetShareEnum

netutils

NetApiBufferFree

wkscli

NetGetJoinInformation

Name

.text

Size

18.5MB

Virtual Size

18.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

IPPCODE

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.5MB

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

984KB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

711KB

Virtual Size

710KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

IPPDATA

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

716KB

Virtual Size

720KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=217, id=261, version=35215,

count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=253, version=35207,

count=18, id=260, version=35207,

count=10, id=259, version=35207,

count=15, id=259, version=35215,

count=127, id=261, version=35207,

count=1, id=262, version=35215,

count=14, id=205, version=50522,

count=54, id=260, version=35215,

count=5, id=257, version=35215,

count=2, id=259, version=35227,

count=336, id=261, version=35227,

count=130, productName=Unmarked objects (old),

count=1017, id=260, version=35227,

count=748, id=1, productName=Unmarked objects,

count=2561, id=265, version=35227,

count=1, id=255, version=35227,

count=1, id=151,

count=1, id=258, version=35227,