912df1fc4f00dc91252097253d100ca834e2213139cf494f5b24d7c02d8fd316

General

Target
2026-07-17_dd9a598d7b09c96f36dcbd31c80dc461_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 14.4MB
Sample260718-b7n1dact4m
SHA256 912df1fc4f00dc91252097253d100ca834e2213139cf494f5b24d7c02d8fd316
MD5 dd9a598d7b09c96f36dcbd31c80dc461
SHA1 1ee55ffa928224ead57c082963d302332deabd86
SHA512 3e8d76e701b69f0d7a70e7a434ad5e0e05e104443c723f56e559d6e94b0c7c9daaebb34fecfb33f1d7a5fc4ceb191037ab79c37452e71d7917a44785e843003d
SSDEEP 393216:PtLL7H0MS85vziqdqUdQJluIF3MnG3pl5nCJP/RKYPeH8YH:PNLJ5vziQBdQt3MGZnCSYex
TLSH
T118E633A1D66E0CCBD405E5F4C04AA5DBCE73AE15B7609196DB426C070DFB3A12C3BA63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-17_dd9a598d7b09c96f36dcbd31c80dc461_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 14.4MB
- SHA256 912df1fc4f00dc91252097253d100ca834e2213139cf494f5b24d7c02d8fd316
- MD5 dd9a598d7b09c96f36dcbd31c80dc461
- SHA1 1ee55ffa928224ead57c082963d302332deabd86
- SHA512 3e8d76e701b69f0d7a70e7a434ad5e0e05e104443c723f56e559d6e94b0c7c9daaebb34fecfb33f1d7a5fc4ceb191037ab79c37452e71d7917a44785e843003d
- SSDEEP 393216:PtLL7H0MS85vziqdqUdQJluIF3MnG3pl5nCJP/RKYPeH8YH:PNLJ5vziQBdQt3MGZnCSYex
- TLSH
  T118E633A1D66E0CCBD405E5F4C04AA5DBCE73AE15B7609196DB426C070DFB3A12C3BA63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer
- Detects executables packed with Babel
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host.
  execution
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2