d4b2d27850eba96cb5efdf43a064f4e4d76d148018d6edf3beef2564152945fc

General

Target
2026-07-09_716745e61d2892abbfacfa88e156d9f7_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 22.1MB
Sample260709-r5graac15v
SHA256 d4b2d27850eba96cb5efdf43a064f4e4d76d148018d6edf3beef2564152945fc
MD5 716745e61d2892abbfacfa88e156d9f7
SHA1 451d056d94f4c3575d75c040f87a9b1e59deb970
SHA512 0e55119c78e45eed1a90cf6a7a8633a65da8c8a3e02716d3f8db51e13d686ef0e5e68c4ec57e8376fc14e4b1d798e3036f11540f2f50e5a11b5cf41e7be412f0
SSDEEP 393216:L85vzasFl7dCR1C99pmG6aw+ngzbMhAKlA6hOKd1+TtIiF6CuARuA2wFXm1qjT/9:45vzJFlUR1OmrzbWlA6801QtILCuA77d
TLSH
T1093733D663F1049BE9F0013A839BC16CEA16B96ACF68D1CB57B019166E1B7E44C3BF41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-09_716745e61d2892abbfacfa88e156d9f7_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 22.1MB
- SHA256 d4b2d27850eba96cb5efdf43a064f4e4d76d148018d6edf3beef2564152945fc
- MD5 716745e61d2892abbfacfa88e156d9f7
- SHA1 451d056d94f4c3575d75c040f87a9b1e59deb970
- SHA512 0e55119c78e45eed1a90cf6a7a8633a65da8c8a3e02716d3f8db51e13d686ef0e5e68c4ec57e8376fc14e4b1d798e3036f11540f2f50e5a11b5cf41e7be412f0
- SSDEEP 393216:L85vzasFl7dCR1C99pmG6aw+ngzbMhAKlA6hOKd1+TtIiF6CuARuA2wFXm1qjT/9:45vzJFlUR1OmrzbWlA6801QtILCuA77d
- TLSH
  T1093733D663F1049BE9F0013A839BC16CEA16B96ACF68D1CB57B019166E1B7E44C3BF41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access spyware stealer adware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2