ef5b38b854a580991563171037cf9d959c3823a303d772292a3f2618e0356ecf

General

Target
2026-07-09_b97cbb756ed3f211ec92437592941461_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 34.8MB
Sample260709-pffrksa12s
SHA256 ef5b38b854a580991563171037cf9d959c3823a303d772292a3f2618e0356ecf
MD5 b97cbb756ed3f211ec92437592941461
SHA1 0ccc19f5678b74d79aacc6c742a1e830bc336806
SHA512 12ac178918b8b5fd250cec2cf47bdcdb36b26c6e3541fdbf46b5f903a1feb61c0fd5b4cddbf853ecedda0bf6f6300105ab1bc3845a0a3b2bff2379a93973ea3f
SSDEEP 786432:v5vzK7I7yZRFlUR1OO03F1ZdlqsBb0i4LLsKMMo5ovsVuROnHNx0SV7e:v9zK7nREWv3FbqsBb9boeOOntx0SE
TLSH
T1CB8733DA72904D8BD6A44279C8539381CDA2B9339750C1CFFBADE354AD873A4593FB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-09_b97cbb756ed3f211ec92437592941461_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 34.8MB
- SHA256 ef5b38b854a580991563171037cf9d959c3823a303d772292a3f2618e0356ecf
- MD5 b97cbb756ed3f211ec92437592941461
- SHA1 0ccc19f5678b74d79aacc6c742a1e830bc336806
- SHA512 12ac178918b8b5fd250cec2cf47bdcdb36b26c6e3541fdbf46b5f903a1feb61c0fd5b4cddbf853ecedda0bf6f6300105ab1bc3845a0a3b2bff2379a93973ea3f
- SSDEEP 786432:v5vzK7I7yZRFlUR1OO03F1ZdlqsBb0i4LLsKMMo5ovsVuROnHNx0SV7e:v9zK7nREWv3FbqsBb9boeOOntx0SE
- TLSH
  T1CB8733DA72904D8BD6A44279C8539381CDA2B9339750C1CFFBADE354AD873A4593FB40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery spyware stealer adware persistence ransomware
- Looks for VirtualBox drivers on disk
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Looks for VMWare drivers on disk
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2