2026-11-01_c35cb0c6bb5678254ae040472b6bf61a_blankgrabber_glassworm_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_c35cb0c6bb5678254ae040472b6bf61a_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 67.6MB
Sample261102-lff6kaef67
SHA256 1b685066891189850a4de3f9902d1b73e2711746226aecd14e8e3ef367c53ba7
MD5 c35cb0c6bb5678254ae040472b6bf61a
SHA1 2ce6a91f57939bd9142b1158fd82ee83038e3e3c
SHA512 ab81602ed7f773152e128e889a92cc0e1767ba779cdd2414b4a1bd5cbea7df753c140a7e846463e5056adcc4454be9768dd3fee44c2438e7ed5cf07cc7bbdc96
SSDEEP 393216:cFK9XjixlXUn0TDu93Whl/lPkkVQSrNbHNujPBNU2Z9AUmlzcX/2ll6jz8pKoflg:v7kPwBNl/Al6jz8F4zdrD
TLSH
T1D5F7AE4DED90D464C69AE43CC4F8403276C31D2DE98B7646734E7A6E3AEEEC4A80175E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

themida

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_c35cb0c6bb5678254ae040472b6bf61a_blankgrabber_glassworm_icedid_luca-stealer_njrat

File Explorer

2026-11-01_c35cb0c6bb5678254ae040472b6bf61a_blankgrabber_glassworm_icedid_luca-stealer_njrat

.exe 67.6MB

2026-11-01_c35cb0c6bb5678254ae040472b6bf61a_blankgrabber_glassworm_icedid_luca-stealer_njrat

SHA256 1b685066891189850a4de3f9902d1b73e2711746226aecd14e8e3ef367c53ba7
MD5 c35cb0c6bb5678254ae040472b6bf61a
SHA1 2ce6a91f57939bd9142b1158fd82ee83038e3e3c
SHA512 ab81602ed7f773152e128e889a92cc0e1767ba779cdd2414b4a1bd5cbea7df753c140a7e846463e5056adcc4454be9768dd3fee44c2438e7ed5cf07cc7bbdc96
SSDEEP 393216:cFK9XjixlXUn0TDu93Whl/lPkkVQSrNbHNujPBNU2Z9AUmlzcX/2ll6jz8pKoflg:v7kPwBNl/Al6jz8F4zdrD
TLSH
T1D5F7AE4DED90D464C69AE43CC4F8403276C31D2DE98B7646734E7A6E3AEEEC4A80175E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with Themida
Detects executables referencing many IR and analysis tools
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64747118

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

769KB

Virtual Size

769KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

172KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7.9MB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

58.8MB

Virtual Size

58.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_c35cb0c6bb5678254ae040472b6bf61a_blankgrabber_glassworm_icedid_luca-stealer_njrat

generic