2026-11-02_ff5c59c4bf91f13df2090f1ea939b8a7_agent-tesla_glassworm_icedid_njrat_poet-rat_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_ff5c59c4bf91f13df2090f1ea939b8a7_agent-tesla_glassworm_icedid_njrat_poet-rat_ryuk_stealc
Size 17.9MB
Sample261102-vlfawsdy4n
SHA256 5717fa78a5d587a2d9fdfb431c068fedd6f6b6ca8983fbc154b65e1f6982431a
MD5 ff5c59c4bf91f13df2090f1ea939b8a7
SHA1 ff460edd9c626f151259aba73bd1ce5d2e5f72f6
SHA512 b885b73beb5b950961ae360b9b0d974ce4f369c740965ba8ab50c3bd9461c277bcbc10cb09d7439771d2284215c5bbfa4890055ef78cd5e8463a143daf6bb412
SSDEEP 196608:r6gcAnHWjkAlwFFC1E36L0/JWjD95ALcpdavx:GmOCCSSyJW5gfv
TLSH
T112177C05B39182EDC43AA3758987AF17F330F844477996FB23B4162D1FE27E85A7A610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_ff5c59c4bf91f13df2090f1ea939b8a7_agent-tesla_glassworm_icedid_njrat_poet-rat_ryuk_stealc

File Explorer

2026-11-02_ff5c59c4bf91f13df2090f1ea939b8a7_agent-tesla_glassworm_icedid_njrat_poet-rat_ryuk_stealc

.exe 17.9MB

2026-11-02_ff5c59c4bf91f13df2090f1ea939b8a7_agent-tesla_glassworm_icedid_njrat_poet-rat_ryuk_stealc

IMPHASH 6bb116fd6be15cdd390cae2421c111f0
SHA256 5717fa78a5d587a2d9fdfb431c068fedd6f6b6ca8983fbc154b65e1f6982431a
MD5 ff5c59c4bf91f13df2090f1ea939b8a7
SHA1 ff460edd9c626f151259aba73bd1ce5d2e5f72f6
SHA512 b885b73beb5b950961ae360b9b0d974ce4f369c740965ba8ab50c3bd9461c277bcbc10cb09d7439771d2284215c5bbfa4890055ef78cd5e8463a143daf6bb412
SSDEEP 196608:r6gcAnHWjkAlwFFC1E36L0/JWjD95ALcpdavx:GmOCCSSyJW5gfv
TLSH
T112177C05B39182EDC43AA3758987AF17F330F844477996FB23B4162D1FE27E85A7A610
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize CreateStreamOnHGlobal

comdlg32

CommDlgExtendedError GetOpenFileNameW

advapi32

GetTokenInformation OpenProcessToken

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CreateDirectoryW CreateFileW CreateHardLinkW CreateRemoteThread CreateSymbolicLinkW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeviceIoControl EnterCriticalSection FindClose FindFirstFileW FindNextFileW FindResourceW FlsAlloc FlsGetValue FlsSetValue FormatMessageA FormatMessageW FreeLibrary GetACP GetActiveProcessorCount GetCommandLineW GetCurrentDirectoryW GetCurrentProcess GetCurrentThreadId GetDiskFreeSpaceExW GetExitCodeThread GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetLastError GetLocaleInfoA GetLocaleInfoEx GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetStartupInfoW GetSystemTimeAsFileTime GetTempPathW GetThreadId GetTickCount64 GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LocalFree LockResource Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadProcessMemory ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SwitchToThread TryAcquireSRWLockExclusive TryEnterCriticalSection VerSetConditionMask VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory

user32

ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetMonitorInfoW GetSystemMetrics GetWindowLongPtrW GetWindowRect IsIconic IsWindowUnicode LoadCursorA MessageBoxW MonitorFromPoint MonitorFromWindow MsgWaitForMultipleObjectsEx OpenClipboard PeekMessageW PostQuitMessage RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetLayeredWindowAttributes SetProcessDPIAware SetWindowLongPtrW SetWindowPos SetWindowRgn ShowWindow TrackMouseEvent TranslateMessage UnregisterClassW

gdi32

CreateRectRgn CreateRoundRectRgn DeleteObject GetDeviceCaps

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsscanf _close _fseeki64 _ftelli64 _get_osfhandle _wfopen _wopen fclose feof ferror fflush fgetc fopen fputc fputwc fread fseek ftell fwrite getc setbuf setvbuf ungetc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln __sys_nerr _assert _beginthreadex _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit strerror strerror_s

api-ms-win-crt-string-l1-1-0

_iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsicmp _wcsxfrm_l isalnum isdigit isspace isxdigit mbrlen memset strcmp strlen strncmp strncpy strnlen tolower toupper wcscmp wcscpy wcslen wcsncmp wcsnlen

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-time-l1-1-0

_localtime64_s _mktime64 _strftime_l _time64 strftime

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen acosf atan2f ceilf cosf expf fmodf log logf lroundf pow powf sinf sqrtf

api-ms-win-crt-convert-l1-1-0

_strtod_l atof mbrtowc mbsrtowcs strtod strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strstr

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-environment-l1-1-0

__p__wenviron getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13.5MB

Virtual Size

13.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

129KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

139KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_ff5c59c4bf91f13df2090f1ea939b8a7_agent-tesla_glassworm_icedid_njrat_poet-rat_ryuk_stealc

d3d11

dwmapi

shell32

ole32

comdlg32

advapi32

kernel32

user32

gdi32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic