da74d9fb246cf74208f554d418329ed1604bef8489a5d42014a314c6aa65999c

General

Target
2026-07-04_c97d06a4cc3301a588636d8e5fd81d53_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 115.4MB
Sample260704-1mcjaaet4w
SHA256 da74d9fb246cf74208f554d418329ed1604bef8489a5d42014a314c6aa65999c
MD5 c97d06a4cc3301a588636d8e5fd81d53
SHA1 3a4764ebc06319c140b6fa61361263ccd47a3169
SHA512 ae974789dc08f2cd322e5b2d9fa1b3ce5b52c8a7b47fe3a0be351ba6413f49fe66b6a923db5160c03e4d7502a5ca71be5a914851d31cd07dcc7ea0fbf5c724cc
SSDEEP 3145728:LL7gYRPSC++6y9/Lp/h8fNknAnIdZcKCm7lxHo4c2S2PnH9b:TxaC4y9jpGfqdhCwoXx2vH9b
TLSH
T1A64833CA7B85644AF89A833372C7DD5E6D61EA4D4286C47687B404770A072D8EB3FE70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-04_c97d06a4cc3301a588636d8e5fd81d53_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 115.4MB
- SHA256 da74d9fb246cf74208f554d418329ed1604bef8489a5d42014a314c6aa65999c
- MD5 c97d06a4cc3301a588636d8e5fd81d53
- SHA1 3a4764ebc06319c140b6fa61361263ccd47a3169
- SHA512 ae974789dc08f2cd322e5b2d9fa1b3ce5b52c8a7b47fe3a0be351ba6413f49fe66b6a923db5160c03e4d7502a5ca71be5a914851d31cd07dcc7ea0fbf5c724cc
- SSDEEP 3145728:LL7gYRPSC++6y9/Lp/h8fNknAnIdZcKCm7lxHo4c2S2PnH9b:TxaC4y9jpGfqdhCwoXx2vH9b
- TLSH
  T1A64833CA7B85644AF89A833372C7DD5E6D61EA4D4286C47687B404770A072D8EB3FE70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence adware spyware
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VirtualBox drivers on disk
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Enumerates processes with tasklist
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2