118b6734a1b152ce4afb4d2b66c764917ab5b0cbf24ce5ef1f8be2c1551ed442 | Triage™

Login
Reports

Overview

overview

9

Static

static

3

2026-07-02...at.exe

windows10-2004-x64

9

2026-07-02...at.exe

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_6e270b7ad0552b601a6bd4ea64e7669c_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 19.7MB
Sample260702-dh98esbt7w
SHA256 118b6734a1b152ce4afb4d2b66c764917ab5b0cbf24ce5ef1f8be2c1551ed442
MD5 6e270b7ad0552b601a6bd4ea64e7669c
SHA1 880fa56b2e54baf9158f41463910b4a91e78bf88
SHA512 f75115abe3f4f3aa9e3b58c1113f2aad19bfbf5a5634a679776fd25cf3760fadab3aa72b8424c7b68b58468335787d96a24a619004eda6eb16e2d7ad4ab29c8a
SSDEEP 393216:rybkCrXM4+Frnqgq3fbsifRioXNF7ICe69qzCVTdzNHsxtrDwH3F1blT/3PpcCVy:Kr84crnqZvbsat5ICe8qzCwtAHVz3PWP
TLSH
T17127334A3F5215E6FAD9A17F4972C595A3E075811F318EBF0B88136A3B031EC0D39AD9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion pyinstaller spyware stealer

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

2026-07-02_6e270b7ad0552b601a6bd4ea64e7669c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

13 signatures

150 seconds

defense_evasion spyware stealer

Behavioral task

behavioral2

Sample

2026-07-02_6e270b7ad0552b601a6bd4ea64e7669c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Resource

win11ltsc2024-20260630-en

windows11-ltsc_2024-x64

10 signatures

150 seconds

defense_evasion spyware stealer

Malware Config

Targets

- Target
  2026-07-02_6e270b7ad0552b601a6bd4ea64e7669c_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 19.7MB
- SHA256 118b6734a1b152ce4afb4d2b66c764917ab5b0cbf24ce5ef1f8be2c1551ed442
- MD5 6e270b7ad0552b601a6bd4ea64e7669c
- SHA1 880fa56b2e54baf9158f41463910b4a91e78bf88
- SHA512 f75115abe3f4f3aa9e3b58c1113f2aad19bfbf5a5634a679776fd25cf3760fadab3aa72b8424c7b68b58468335787d96a24a619004eda6eb16e2d7ad4ab29c8a
- SSDEEP 393216:rybkCrXM4+Frnqgq3fbsifRioXNF7ICe69qzCVTdzNHsxtrDwH3F1blT/3PpcCVy:Kr84crnqZvbsat5ICe8qzCwtAHVz3PWP
- TLSH
  T17127334A3F5215E6FAD9A17F4972C595A3E075811F318EBF0B88136A3B031EC0D39AD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion spyware stealer
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VirtualBox drivers on disk
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

Ignore Process Interrupts

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

File and Directory Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasionspywarestealer

behavioral2

defense_evasionspywarestealer

© 2018-2026

Terms | Privacy