912f746eb61ed8efeece1d9ed8c410ff844328dfb61366d7e5c60f582bbe2d45

General

Target
2026-07-13_932cce5de5d09d965b55ce1ed21408d0_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 67.6MB
Sample260713-e14n2ady2x
SHA256 912f746eb61ed8efeece1d9ed8c410ff844328dfb61366d7e5c60f582bbe2d45
MD5 932cce5de5d09d965b55ce1ed21408d0
SHA1 4ab19daf611114305946b8c12aed104eb9dea5b1
SHA512 ad63ccc09a5c06b474f44989fd32a102e0aa12a6d161fe1b113c2eecd820de2a478cb2f0e9bd0c15648001383e808b81b37654a9526d33a8316b778fba3b38fa
SSDEEP 786432:97k9ljbmaV1B0XyR/NPRHq0IokDS7TsV7qRK4FEEKm5:9GmafBx/PHqfXucV7qRKaKm5
TLSH
T17BF7BFD610DADD4AC7364836AAC816D78159EC785F20A123DC3EDF134BE2BE403659AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-13_932cce5de5d09d965b55ce1ed21408d0_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 67.6MB
- SHA256 912f746eb61ed8efeece1d9ed8c410ff844328dfb61366d7e5c60f582bbe2d45
- MD5 932cce5de5d09d965b55ce1ed21408d0
- SHA1 4ab19daf611114305946b8c12aed104eb9dea5b1
- SHA512 ad63ccc09a5c06b474f44989fd32a102e0aa12a6d161fe1b113c2eecd820de2a478cb2f0e9bd0c15648001383e808b81b37654a9526d33a8316b778fba3b38fa
- SSDEEP 786432:97k9ljbmaV1B0XyR/NPRHq0IokDS7TsV7qRK4FEEKm5:9GmafBx/PHqfXucV7qRKaKm5
- TLSH
  T17BF7BFD610DADD4AC7364836AAC816D78159EC785F20A123DC3EDF134BE2BE403659AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion evasion execution ransomware themida trojan
- Detects executables packed with Themida
- Detects executables referencing many IR and analysis tools
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2