b07091734f2766a6210971024478294503ec4392030b32fbf49f365829d56fbf

General

Target
2026-07-01_2bfdb6feb0c7d93b8e0d51e7edc324d2_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc
Size 11.5MB
Sample260701-mbjxbsbv3m
SHA256 b07091734f2766a6210971024478294503ec4392030b32fbf49f365829d56fbf
MD5 2bfdb6feb0c7d93b8e0d51e7edc324d2
SHA1 a2ca11126530f6f72b154001ede49b7e97b4dbd0
SHA512 38a4e066bee29cf3065e8e691ece3762d0de3aebef0d773a4e5e338425b99ef6c38c3f6c8f3beacdc5dcda2905ca7dcafc281a3541f0293b05482a8f9d8f0123
SSDEEP 196608:Bu1GBeZ+tlfBa+IxbnxGagsvrUjPp+e/M8QV:PBeZ+tZBa+IxbnxGagsvrUjPp+e/MT
TLSH
T12CC69D69B1B800D9E577C0B8CA569213E772741813F047EB66949AF92F23BE07E7B740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-01_2bfdb6feb0c7d93b8e0d51e7edc324d2_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc
- Size 11.5MB
- SHA256 b07091734f2766a6210971024478294503ec4392030b32fbf49f365829d56fbf
- MD5 2bfdb6feb0c7d93b8e0d51e7edc324d2
- SHA1 a2ca11126530f6f72b154001ede49b7e97b4dbd0
- SHA512 38a4e066bee29cf3065e8e691ece3762d0de3aebef0d773a4e5e338425b99ef6c38c3f6c8f3beacdc5dcda2905ca7dcafc281a3541f0293b05482a8f9d8f0123
- SSDEEP 196608:Bu1GBeZ+tlfBa+IxbnxGagsvrUjPp+e/M8QV:PBeZ+tZBa+IxbnxGagsvrUjPp+e/MT
- TLSH
  T12CC69D69B1B800D9E577C0B8CA569213E772741813F047EB66949AF92F23BE07E7B740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery execution persistence spyware stealer
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects executables containing possible sandbox analysis VM names
- Custom signature
  
  Detects executables containing possible sandbox analysis VM usernames
- Custom signature
  
  Detects executables containing possible sandbox system UUIDs
- Custom signature
  
  Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2