2026-11-06_feadf143f551f61c5bdbbe37b5130755_blankgrabber_coinminer_glassworm_icedid_njrat_poet-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-06_feadf143f551f61c5bdbbe37b5130755_blankgrabber_coinminer_glassworm_icedid_njrat_poet-rat
Size 47.2MB
Sample261107-wa41jsfe53
SHA256 74d2fa71aef8b793bccf21c72fdb5a9fd4218091dd4479d4fea3415fb44e50ec
MD5 feadf143f551f61c5bdbbe37b5130755
SHA1 8f4a964f48e4f7ce7499aa93b53eb1f85b8abfbb
SHA512 b0b580bc9bfb1a59e057818e0fb16b11d144933560b2ed7211c657cb075e4efd310f01a150ea229e36a17a355152b83cdaf2f6c9b5a420c716a4250bcd85f241
SSDEEP 393216:HWrde/HQ2hhTZ7wOh6u6OIz1eKUMZT4WdAwS4/JYVtsCxENK/GoQIKFdu9CwJsvo:H5kR4Lw1rMaI6/37lGP9GjiTHpMigc1
TLSH
T195B77B0662F40195E0BBD539DA22C5B3E7B2BCC65B30924B21E47E67BF736605D2A331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-06_feadf143f551f61c5bdbbe37b5130755_blankgrabber_coinminer_glassworm_icedid_njrat_poet-rat

.exe 47.2MB

2026-11-06_feadf143f551f61c5bdbbe37b5130755_blankgrabber_coinminer_glassworm_icedid_njrat_poet-rat

IMPHASH 6d062e6f504e0838ae6e8c3982503e94
SHA256 74d2fa71aef8b793bccf21c72fdb5a9fd4218091dd4479d4fea3415fb44e50ec
MD5 feadf143f551f61c5bdbbe37b5130755
SHA1 8f4a964f48e4f7ce7499aa93b53eb1f85b8abfbb
SHA512 b0b580bc9bfb1a59e057818e0fb16b11d144933560b2ed7211c657cb075e4efd310f01a150ea229e36a17a355152b83cdaf2f6c9b5a420c716a4250bcd85f241
SSDEEP 393216:HWrde/HQ2hhTZ7wOh6u6OIz1eKUMZT4WdAwS4/JYVtsCxENK/GoQIKFdu9CwJsvo:H5kR4Lw1rMaI6/37lGP9GjiTHpMigc1
TLSH
T195B77B0662F40195E0BBD539DA22C5B3E7B2BCC65B30924B21E47E67BF736605D2A331
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

0e:95:85:f4:e5:ae:34:80:87:c5:96:99:7a:b7:21:17:6a:f2:cb:db:f7:ab:8b:05:2b:e9:dc:62:ea:fa:b2:7d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Advanced Micro Devices,O=Advanced Micro Devices,ST=California,C=US

Chains

Oct 24, 2026

CN=Advanced Micro Devices,O=Advanced Micro Devices,ST=California,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Advanced Micro Devices,O=Advanced Micro Devices,ST=California,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Advanced Micro Devices,O=Advanced Micro Devices,ST=California,C=US

Serial Number

a5:ad:09:b4:ca:dc:93:29:eb:fe:45:23:43:cf:42:5f

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2024 - Apr 26, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

24155236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\constructicon\builds\gfx\six\26.20\install\Neoma\cmake_build\InstallNeoma\UI\Release\AMDSoftwareInstaller.pdb

activeds

ord9

cfgmgr32

CM_Reenumerate_DevNode_Ex CM_Get_Device_ID_ListW CM_Get_Device_ID_List_SizeW CM_Locate_DevNode_ExW CM_Get_DevNode_Registry_PropertyW CM_Locate_DevNodeW CM_Reenumerate_DevNode

gdi32

GetCharABCWidthsI GetOutlineTextMetricsW SetGraphicsMode SetTextColor SetTextAlign GetCharWidthI GetTextExtentPoint32W SetBkMode SetWorldTransform ExtTextOutW CreateDIBSection GdiFlush SelectClipRgn BitBlt ChoosePixelFormat SetPixelFormat OffsetRgn SetLayout CreateCompatibleBitmap CreateDCW CreateRectRgn DescribePixelFormat GetCharABCWidthsFloatW SwapBuffers GetBitmapBits GetObjectW CreateFontIndirectA GetCharWidthW CreateFontA EnumFontFamiliesExA GetTextFaceA GetDIBits GetGlyphOutlineW GetCharABCWidthsW GetTextFaceW GetTextMetricsW SelectObject RemoveFontMemResourceEx AddFontMemResourceEx RemoveFontResourceExW AddFontResourceExW GetFontData EnumFontFamiliesExW CreateFontIndirectW CreateCompatibleDC GetStockObject DeleteDC GetRegionData GetPixelFormat DeleteObject CombineRgn CreateBitmap GetDeviceCaps

msi

ord72 ord285 ord286 ord70 ord281 ord8 ord118 ord115 ord88 ord205 ord169 ord141 ord94 ord171

setupapi

SetupGetStringFieldW SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiGetDeviceInstanceIdW SetupDiBuildDriverInfoList SetupDiEnumDriverInfoW SetupDiGetDriverInfoDetailW SetupFindNextLine SetupFindFirstLineW SetupCloseInfFile SetupOpenInfFileW SetupGetLineTextW SetupDiGetDeviceInterfaceDetailW SetupDiOpenDeviceInterfaceW SetupGetInfPublishedNameW SetupGetInfDriverStoreLocationW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetINFClassW SetupDiCallClassInstaller SetupDiOpenDevRegKey SetupDiGetDevicePropertyW SetupDiSetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW SetupDiRemoveDevice SetupUninstallOEMInfW SetupCopyOEMInfW

urlmon

URLDownloadToFileW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

SetFileAttributesW GetDynamicTimeZoneInformation GetFirmwareType HeapAlloc HeapFree GetProcessHeap GetLogicalDriveStringsW GlobalMemoryStatusEx IsValidLocale GetTickCount GetModuleHandleA GetFileSize GetUserDefaultLangID GetUserDefaultLocaleName InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared VirtualAlloc VirtualProtect VirtualFree RtlAddFunctionTable RtlDeleteFunctionTable IsDebuggerPresent RaiseException EnterCriticalSection LeaveCriticalSection GetOverlappedResult FindNextChangeNotification FindFirstChangeNotificationW FindCloseChangeNotification WriteConsoleW GetOEMCP IsValidCodePage HeapQueryInformation HeapSize HeapReAlloc EnumSystemLocalesW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode SetStdHandle GetCommandLineA FreeLibraryAndExitThread ExitThread CreateThread ExitProcess TlsFree InitializeCriticalSectionAndSpinCount RtlUnwind InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx InitializeSListHead GetStartupInfoW GetCPInfo PeekNamedPipe EncodePointer CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetTickCount64 SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetExitCodeThread GetStringTypeW InitOnceBeginInitialize InitOnceComplete RtlPcToFileHeader AreFileApisANSI GetFinalPathNameByHandleW GetDiskFreeSpaceExW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GlobalFree WaitForMultipleObjects WaitNamedPipeW DisconnectNamedPipe InitOnceExecuteOnce FindNextFileA FindFirstFileExA CreateMutexW ReleaseMutex InitializeCriticalSection GetLocaleInfoEx GetSystemTimeAsFileTime QueryPerformanceFrequency QueryPerformanceCounter GetSystemDirectoryA TlsAlloc TlsGetValue Module32FirstW LCIDToLocaleName GetDateFormatEx GetTimeFormatEx GetComputerNameW GetWindowsDirectoryW ProcessIdToSessionId GetProcessTimes DeleteCriticalSection InitializeCriticalSectionEx CancelIoEx CreatePipe GetWindowsDirectoryA FormatMessageA TlsSetValue TryAcquireSRWLockExclusive lstrcmpW LoadLibraryA FindNextFileW FindFirstFileExW ExpandEnvironmentStringsW CheckRemoteDebuggerPresent GlobalLock GlobalUnlock GlobalSize GlobalAlloc WTSGetActiveConsoleSessionId VirtualQuery LoadLibraryW GetModuleHandleExW FreeLibrary GetGeoInfoW GetNativeSystemInfo GetComputerNameExW GetProcessId WaitForMultipleObjectsEx CreateNamedPipeW ConnectNamedPipe SetLastError SetHandleInformation DecodePointer GetFileSizeEx CloseThreadpoolWait WaitForThreadpoolWaitCallbacks SetThreadpoolWait CreateThreadpoolWait WaitForThreadpoolWorkCallbacks SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW WaitForSingleObjectEx ResetEvent SetEvent GetUserPreferredUILanguages GetUserDefaultLCID GetCurrencyFormatW LocaleNameToLCID GetLocaleInfoW GetTimeFormatW GetDateFormatW LCMapStringW CompareStringW SetFilePointerEx SetFileInformationByHandle ReadFile GetVolumeInformationW GetFileType GetDriveTypeW GetTimeZoneInformation GetFileInformationByHandleEx SystemTimeToFileTime FileTimeToSystemTime TzSpecificLocalTimeToSystemTime MoveFileExW MoveFileW CopyFileW DeviceIoControl SetErrorMode GetVolumePathNamesForVolumeNameW SetFileTime RemoveDirectoryW GetLongPathNameW GetLogicalDrives GetFullPathNameW GetFileInformationByHandle GetFileAttributesW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW AttachConsole FreeConsole AllocConsole GetStdHandle FormatMessageW LocalAlloc GetACP WideCharToMultiByte GetFileAttributesExW FlushFileBuffers SetThreadDescription SetThreadInformation ResumeThread TerminateThread GetThreadPriority SetThreadPriority GetCurrentThreadId GetCurrentThread SwitchToThread UnmapViewOfFile MapViewOfFile CreateFileMappingW GetSystemInfo GetLocalTime GetSystemTime LocalFree IsProcessorFeaturePresent TerminateProcess GetCommandLineW SetDefaultDllDirectories EnumDateFormatsExEx GetVersionExW GetModuleFileNameW MultiByteToWideChar VerifyVersionInfoW GetModuleHandleW VerSetConditionMask GetProcAddress Sleep GetTempPathW GetConsoleWindow OutputDebugStringW CompareStringEx CreateSemaphoreW ReleaseSemaphore CreateEventW GetLastError MulDiv GetCurrentProcessId GetUserGeoID Process32FirstW DeleteFileW Process32NextW CreateToolhelp32Snapshot CreateFileW SetEndOfFile WriteFile lstrlenW GetCurrentProcess LoadLibraryExW GetExitCodeProcess K32EnumProcessModules CreateProcessW GetCurrentPackageFullName CloseHandle OpenProcess GetSystemDirectoryW WaitForSingleObject GetEnvironmentVariableW K32GetModuleFileNameExW LCMapStringEx SetEnvironmentVariableW

user32

SetCaretPos ShowCaret DestroyCaret CreateCaret IsWindowEnabled GetKeyboardLayout GetPointerInfo SendInput SetDisplayAutoRotationPreferences EnumDisplayMonitors SetMenuItemInfoW GetMenuItemInfoW RemoveMenu MonitorFromPoint GetWindowLongW MessageBoxW PostQuitMessage LoadIconW TranslateMessage DispatchMessageW RegisterClassExW CreateWindowExW DestroyWindow PostMessageW DefWindowProcW GetMessageW DestroyIcon GetWindowTextW SetForegroundWindow FindWindowW BringWindowToTop ModifyMenuW AppendMenuW InsertMenuW DestroyMenu CreatePopupMenu CreateMenu DrawMenuBar SetMenu RemoveClipboardFormatListener AddClipboardFormatListener ChangeClipboardChain SetClipboardViewer IsHungAppWindow GetAncestor GetDpiForWindow MonitorFromWindow DestroyCursor SetMenuDefaultItem TrackPopupMenuEx HiliteMenuItem GetWindow SetParent MapWindowPoints SetCursor AdjustWindowRectExForDpi AdjustWindowRectEx SetWindowTextW SetWindowRgn GetUpdateRect TrackMouseEvent GetMessageExtraInfo GetPointerType GetPointerFrameTouchInfo GetPointerFrameTouchInfoHistory GetPointerPenInfo GetPointerPenInfoHistory MapVirtualKeyW SetCursorPos EnumWindows ExitWindowsEx IsWindowVisible FindWindowExW GetWindowTextLengthW CharPrevExA PeekMessageW RegisterClassW EndPaint BeginPaint GetForegroundWindow SetActiveWindow TrackPopupMenu GetMenu ReleaseCapture SetCapture GetCapture IsTouchWindow UnregisterTouchWindow RegisterTouchWindow GetAsyncKeyState SetFocus IsIconic SetWindowPlacement MoveWindow ToAscii GetKeyboardState GetKeyState FlashWindowEx SetLayeredWindowAttributes UpdateLayeredWindow ShowWindow IsChild AttachThreadInput EnumDisplayDevicesW GetClipboardFormatNameW RegisterClipboardFormatW ChangeWindowMessageFilter SetProcessDpiAwarenessContext EnableNonClientDpiScaling IsValidDpiAwarenessContext AreDpiAwarenessContextsEqual GetWindowDpiAwarenessContext GetThreadDpiAwarenessContext GetCursor SkipPointerFrameMessages GetPointerDeviceRects ChangeWindowMessageFilterEx DrawIconEx UnregisterClassW GetQueueStatus MsgWaitForMultipleObjectsEx SetWindowLongW InvalidateRect ReleaseDC RegisterDeviceNotificationW UnregisterDeviceNotification LoadImageW GetParent ChildWindowFromPointEx WindowFromPoint ScreenToClient ClientToScreen GetCursorPos GetClientRect GetFocus FindWindowA IsZoomed GetWindowPlacement GetClassInfoW LoadCursorW CreateCursor CreateIconIndirect GetIconInfo ToUnicode GetCursorInfo UnregisterPowerSettingNotification RegisterPowerSettingNotification GetMessageTime RegisterWindowMessageW GetKeyboardLayoutList UpdateLayeredWindowIndirect GetCaretBlinkTime MessageBeep IsWindow GetDoubleClickTime GetDesktopWindow GetMonitorInfoW SendMessageW SetWindowPos GetDC SetTimer SetCoalescableTimer KillTimer GetWindowLongPtrW SetWindowLongPtrW PostThreadMessageW GetWindowThreadProcessId CreateDesktopW CloseDesktop SendMessageTimeoutW GetSystemMetrics GetWindowInfo SystemParametersInfoW SystemParametersInfoForDpi GetDisplayConfigBufferSizes QueryDisplayConfig DisplayConfigGetDeviceInfo GetSystemMenu EnableMenuItem GetSystemMetricsForDpi GetSysColor GetWindowRect

winhttp

WinHttpOpenRequest WinHttpGetIEProxyConfigForCurrentUser WinHttpSendRequest WinHttpQueryDataAvailable WinHttpGetDefaultProxyConfiguration WinHttpGetProxyForUrl WinHttpReadData WinHttpOpen WinHttpQueryHeaders WinHttpCloseHandle WinHttpReceiveResponse WinHttpConnect

wininet

HttpSendRequestW HttpOpenRequestW HttpOpenRequestA InternetGetLastResponseInfoW InternetSetOptionW InternetSetOptionA HttpQueryInfoW InternetConnectW InternetCloseHandle InternetOpenW InternetCrackUrlW DeleteUrlCacheEntryW InternetCheckConnectionW InternetReadFile HttpAddRequestHeadersW

wtsapi32

WTSFreeMemory WTSUnRegisterSessionNotification WTSRegisterSessionNotification WTSQuerySessionInformationW

imm32

ImmGetVirtualKey ImmGetContext ImmReleaseContext ImmAssociateContext ImmAssociateContextEx ImmGetCompositionStringW ImmGetOpenStatus ImmNotifyIME ImmSetCompositionWindow ImmSetCandidateWindow ImmGetDefaultIMEWnd

shlwapi

PathIsDirectoryW AssocQueryStringW PathFileExistsW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

comdlg32

GetSaveFileNameW GetOpenFileNameW

d3d9

Direct3DCreate9

uiautomationcore

UiaRaiseAutomationEvent UiaRaiseNotificationEvent UiaHostProviderFromHwnd UiaRaiseAutomationPropertyChangedEvent UiaClientsAreListening UiaReturnRawElementProvider

oleaut32

SafeArrayPutElement SetErrorInfo GetErrorInfo VariantCopy VariantClear SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantInit SafeArrayCreateVector

iphlpapi

ConvertInterfaceIndexToLuid ConvertInterfaceNameToLuidW ConvertInterfaceLuidToNameW ConvertInterfaceLuidToIndex GetAdaptersAddresses ConvertInterfaceLuidToGuid

crypt32

CertGetNameStringW CryptVerifyMessageSignature CertOpenStore CertCloseStore CertFindCertificateInStore CertDuplicateCertificateContext CertAddStoreToCollection CertVerifyTimeValidity CertGetCertificateChain CertFreeCertificateChain CertFindChainInStore PFXImportCertStore CryptEncodeObject CertGetCertificateContextProperty CertCompareCertificate CertFreeCertificateContext

secur32

AcceptSecurityContext QueryContextAttributesW FreeCredentialsHandle AcquireCredentialsHandleW DeleteSecurityContext ApplyControlToken FreeContextBuffer DecryptMessage InitSecurityInterfaceW InitializeSecurityContextW EncryptMessage

bcrypt

BCryptEncrypt BCryptDecrypt BCryptFinishHash BCryptSetProperty BCryptEnumContextFunctions BCryptFreeBuffer BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptImportKeyPair BCryptDestroyKey BCryptDestroyHash

ncrypt

NCryptExportKey NCryptSetProperty

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

d3d12

ord101 D3D12SerializeVersionedRootSignature ord102

dwrite

DWriteCreateFactory

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea DwmIsCompositionEnabled DwmSetWindowAttribute

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock GetUserProfileDirectoryW

advapi32

GetUserNameW StartServiceW QueryServiceStatusEx ReportEventW RegisterEventSourceW DeregisterEventSource CheckTokenMembership LsaQueryInformationPolicy LsaOpenPolicy LsaClose LsaFreeMemory ConvertSecurityDescriptorToStringSecurityDescriptorW ConvertSidToStringSidW SetEntriesInAclW QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService ControlService CloseServiceHandle ChangeServiceConfigW InitiateSystemShutdownExW LookupAccountNameW SetFileSecurityW CreateWellKnownSid GetSidSubAuthorityCount GetSidSubAuthority RegQueryInfoKeyW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteKeyW GetNamedSecurityInfoW LookupAccountSidW SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid FreeSid DuplicateToken CopySid AllocateAndInitializeSid AddAccessDeniedAceEx AddAccessAllowedAceEx SystemFunction036 RegNotifyChangeKeyValue LookupPrivilegeValueW AdjustTokenPrivileges RegDeleteKeyValueW RegDeleteTreeW OpenProcessToken RegGetValueW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegCloseKey RegCreateKeyExW RegSetValueExW

authz

AuthzInitializeContextFromSid AuthzFreeResourceManager AuthzFreeContext AuthzInitializeContextFromToken AuthzAccessCheck AuthzInitializeResourceManager

netapi32

NetUserGetLocalGroups NetApiBufferFree NetShareEnum

ole32

CoInitialize CoCreateInstance CoGetMalloc DoDragDrop OleIsCurrentClipboard OleFlushClipboard OleGetClipboard OleSetClipboard RevokeDragDrop RegisterDragDrop CoLockObjectExternal ReleaseStgMedium OleUninitialize OleInitialize StringFromGUID2 CoInitializeSecurity CoSetProxyBlanket OleRun IIDFromString CoInitializeEx CoUninitialize CoCreateGuid CoTaskMemFree CoCreateFreeThreadedMarshaler

winmm

timeSetEvent timeKillEvent timeGetTime PlaySoundW

ws2_32

WSAIoctl WSAHtonl WSAConnect WSAAccept WSAGetLastError setsockopt select listen htons getsockname getpeername WSARecvFrom WSANtohl __WSAFDIsSet getsockopt getnameinfo freeaddrinfo getaddrinfo ntohl htonl WSACleanup WSAStartup WSAAsyncSelect WSANtohs WSASend WSASendTo bind WSARecv WSASocketW closesocket

shell32

SHGetFileInfoW SHParseDisplayName ord155 SHGetFolderLocation SHGetPathFromIDListW SHGetMalloc SHFileOperationW ord680 FindExecutableW SHChangeNotify ShellExecuteExW CommandLineToArgvW SHGetKnownFolderPath SHCreateDirectoryExW SHCreateItemFromParsingName SHGetStockIconInfo Shell_NotifyIconGetRect Shell_NotifyIconW SHBrowseForFolderW SHGetKnownFolderIDList SHCreateItemFromIDList ShellExecuteW ord6 ord727

uxtheme

GetCurrentThemeName IsAppThemed IsThemeActive SetWindowTheme OpenThemeData CloseThemeData ord47 GetThemeBackgroundRegion GetThemePartSize IsThemeBackgroundPartiallyTransparent GetThemeColor GetThemeBool GetThemeInt GetThemeEnumValue GetThemeMargins GetThemePropertyOrigin GetThemeTransitionDuration

rstrtmgr

RmRegisterResources RmStartSession RmEndSession RmShutdown RmGetList

api-ms-win-core-path-l1-1-0

PathCchRemoveBackslash

xmllite

CreateXmlReaderInputWithEncodingName CreateXmlWriter CreateXmlWriterOutputWithEncodingName CreateXmlReader

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

newdev

DiInstallDriverW UpdateDriverForPlugAndPlayDevicesW

powrprof

PowerDeterminePlatformRoleEx

wintrust

WinVerifyTrust

imagehlp

ImageEnumerateCertificates ImageGetCertificateData

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

25.3MB

Virtual Size

25.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15.6MB

Virtual Size

15.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

942KB

Virtual Size

7.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

951KB

Virtual Size

951KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmimed

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

259KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-06_feadf143f551f61c5bdbbe37b5130755_blankgrabber_coinminer_glassworm_icedid_njrat_poet-rat

activeds

cfgmgr32

gdi32

msi

setupapi

urlmon

version

kernel32

user32

winhttp

wininet

wtsapi32

imm32

shlwapi

api-ms-win-shcore-scaling-l1-1-1

comdlg32

d3d9

uiautomationcore

oleaut32

iphlpapi

crypt32

secur32

bcrypt

ncrypt

d3d11

dxgi

d3d12

dwrite

dwmapi

api-ms-win-core-synch-l1-2-0

userenv

advapi32

authz

netapi32

ole32

winmm

ws2_32

shell32

uxtheme

rstrtmgr

api-ms-win-core-path-l1-1-0

xmllite

rpcrt4

newdev

powrprof

wintrust

imagehlp

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

generic