2026-11-07_081ed985ba0ee9e0882e76e5243e3693_agent-tesla_glassworm_icedid_njrat_poet-rat_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_081ed985ba0ee9e0882e76e5243e3693_agent-tesla_glassworm_icedid_njrat_poet-rat_ryuk_stealc
Size 18.9MB
Sample261107-vts7qaev5r
SHA256 ab8077b99b9965bea75cda0c5848c5196c4176d92f93a6807d3685f97b721388
MD5 081ed985ba0ee9e0882e76e5243e3693
SHA1 64601d1b1405070aaf3296cb44623a984a8264ef
SHA512 14a1992bc0f856268a242deeed0a2bb99b2fcc1a7282f62e38b0c625aeedaed8b913a689b5dbea113e367a3c40608dd2c03917b42927d8bd151b15cc0263dd18
SSDEEP 196608:SbBixNJkAlIWS7RR38Lp/aPrDc2cNcpdyvx2aha:oBqVU7rMRaE22Tv
TLSH
T136178D05B39182EDC43AA3758987AF17F330F844477A96EB23B4161D1FE37E84A7A611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_081ed985ba0ee9e0882e76e5243e3693_agent-tesla_glassworm_icedid_njrat_poet-rat_ryuk_stealc

File Explorer

2026-11-07_081ed985ba0ee9e0882e76e5243e3693_agent-tesla_glassworm_icedid_njrat_poet-rat_ryuk_stealc

.exe 18.9MB

2026-11-07_081ed985ba0ee9e0882e76e5243e3693_agent-tesla_glassworm_icedid_njrat_poet-rat_ryuk_stealc

IMPHASH 38b9aec6a7cd7731c4186fd9bd286111
SHA256 ab8077b99b9965bea75cda0c5848c5196c4176d92f93a6807d3685f97b721388
MD5 081ed985ba0ee9e0882e76e5243e3693
SHA1 64601d1b1405070aaf3296cb44623a984a8264ef
SHA512 14a1992bc0f856268a242deeed0a2bb99b2fcc1a7282f62e38b0c625aeedaed8b913a689b5dbea113e367a3c40608dd2c03917b42927d8bd151b15cc0263dd18
SSDEEP 196608:SbBixNJkAlIWS7RR38Lp/aPrDc2cNcpdyvx2aha:oBqVU7rMRaE22Tv
TLSH
T136178D05B39182EDC43AA3758987AF17F330F844477A96EB23B4161D1FE37E84A7A611
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize CreateStreamOnHGlobal StringFromGUID2

comdlg32

CommDlgExtendedError GetOpenFileNameW

advapi32

GetTokenInformation OpenProcessToken

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CreateDirectoryW CreateFileW CreateHardLinkW CreateMutexW CreateRemoteThread CreateSymbolicLinkW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeviceIoControl EnterCriticalSection FindClose FindFirstFileW FindNextFileW FindResourceW FlsAlloc FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeLibrary GetACP GetActiveProcessorCount GetCommandLineW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExW GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFinalPathNameByHandleW GetLastError GetLocaleInfoA GetLocaleInfoEx GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessTimes GetStartupInfoW GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadId GetTickCount64 GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitOnceExecuteOnce InitializeCriticalSection IsWow64Process K32EnumProcessModulesEx K32GetModuleBaseNameW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockResource MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SwitchToThread TryAcquireSRWLockExclusive TryEnterCriticalSection VerSetConditionMask VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory

user32

ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetMonitorInfoW GetSystemMetrics GetWindowLongPtrW GetWindowRect IsIconic IsWindowUnicode LoadCursorA MessageBoxW MonitorFromPoint MonitorFromWindow MsgWaitForMultipleObjectsEx OpenClipboard PeekMessageW PostQuitMessage RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetLayeredWindowAttributes SetProcessDPIAware SetWindowLongPtrW SetWindowPos SetWindowRgn ShowWindow TrackMouseEvent TranslateMessage UnregisterClassW

gdi32

CreateRectRgn CreateRoundRectRgn DeleteObject GetDeviceCaps

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsscanf _close _fseeki64 _ftelli64 _get_osfhandle _wfopen _wopen fclose feof ferror fflush fgetc fopen fputc fputwc fread fseek ftell fwrite getc setbuf setvbuf ungetc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln __sys_nerr _assert _beginthreadex _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit strerror strerror_s

api-ms-win-crt-string-l1-1-0

_iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsicmp _wcsnicmp _wcsxfrm_l isalnum isdigit isspace isxdigit mbrlen memset strcmp strlen strncmp strncpy strnlen tolower toupper wcscmp wcscpy wcslen wcsncmp wcsnlen

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-time-l1-1-0

_localtime64_s _mktime64 _strftime_l _time64 strftime

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen acosf atan2f ceilf cosf expf fmodf log logf lroundf pow powf sinf sqrtf

api-ms-win-crt-convert-l1-1-0

_strtod_l atof mbrtowc mbsrtowcs strtod strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strstr

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-environment-l1-1-0

__p__wenviron getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14.3MB

Virtual Size

14.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

129KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

139KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_081ed985ba0ee9e0882e76e5243e3693_agent-tesla_glassworm_icedid_njrat_poet-rat_ryuk_stealc

d3d11

dwmapi

shell32

ole32

comdlg32

advapi32

bcrypt

kernel32

user32

gdi32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic