General
- Target 2026-04-19_905a3be3b89953d4ded8cabec97f84f5_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 8.8MB
- Sample260419-ejyrfsht8s
- SHA256 9358fb47c5046de2730e32373980078930bd04d361fa9635fff4ad15a670a7e6
Score
10/10
Malware Config
Targets
-
- Target 2026-04-19_905a3be3b89953d4ded8cabec97f84f5_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 8.8MB
- SHA256 9358fb47c5046de2730e32373980078930bd04d361fa9635fff4ad15a670a7e6
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Disables service(s)
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Stops running service(s)
-
Windows security modification
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4