36ffce8c75f3ac549ac043810138c804aeab883e01122a167c25dff64eafd3ab

General

Target
2026-07-03_4f060e53533798b7ab6b0499d7587fdd_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 7.8MB
Sample260703-tkvhraht9n
SHA256 36ffce8c75f3ac549ac043810138c804aeab883e01122a167c25dff64eafd3ab
MD5 4f060e53533798b7ab6b0499d7587fdd
SHA1 00210a97a7b20ed990ac2d0dcb64c4d0b8e80ca7
SHA512 d96e1d035fb6ac3152f720b339b34fe3f1facd6d337f458a38358002a7e73a422f82be7ddd3fdf02cbc557f3faf9e7cc9440c3ad25cfa14213848b96ebad4c90
SSDEEP 196608:7BNTwhL1vlRA1HeT39IigbauDXURuAEk0ax8ZGW:7WLFla1+TtIihuARuAUax6GW
TLSH
T106863395A3B504E5E9F6863E8276C11CE263744B8765D2DF17E00A922F27BF00E3AF51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-03_4f060e53533798b7ab6b0499d7587fdd_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 7.8MB
- SHA256 36ffce8c75f3ac549ac043810138c804aeab883e01122a167c25dff64eafd3ab
- MD5 4f060e53533798b7ab6b0499d7587fdd
- SHA1 00210a97a7b20ed990ac2d0dcb64c4d0b8e80ca7
- SHA512 d96e1d035fb6ac3152f720b339b34fe3f1facd6d337f458a38358002a7e73a422f82be7ddd3fdf02cbc557f3faf9e7cc9440c3ad25cfa14213848b96ebad4c90
- SSDEEP 196608:7BNTwhL1vlRA1HeT39IigbauDXURuAEk0ax8ZGW:7WLFla1+TtIihuARuAUax6GW
- TLSH
  T106863395A3B504E5E9F6863E8276C11CE263744B8765D2DF17E00A922F27BF00E3AF51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery persistence spyware stealer
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
behavioral1 behavioral2