6543d268607f7694907dfe2154c3b2d2986024a1b55c2ea28b62831d0dabe72e

General

Target
2026-07-19_7a4ebd003d023e202a0066dc4856ce35_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 60.8MB
Sample260719-caqndahs9n
SHA256 6543d268607f7694907dfe2154c3b2d2986024a1b55c2ea28b62831d0dabe72e
MD5 7a4ebd003d023e202a0066dc4856ce35
SHA1 faab03610070170c76e837720d909d3f2b7f45e7
SHA512 b99ea4f2ec5527a32d681506c1070da2df17313392ce4470bff2c2a4e7e8914deb8059619de5d9df923fce900d3b52d89dbaf0117a1b8cc55e154a1ea1aa6ed0
SSDEEP 1572864:2TSJ3P3R8fNknAnZ2yOogqTcaNH21A/BNNfUcj/xWSaED://h8fNknAnIdA7lxpUcj/xWc
TLSH
T1B1D7339E3B8275C2F5AEC27A1505D93FAE71DA0C0B4B447763A418353E272F65A2F630
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-19_7a4ebd003d023e202a0066dc4856ce35_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 60.8MB
- SHA256 6543d268607f7694907dfe2154c3b2d2986024a1b55c2ea28b62831d0dabe72e
- MD5 7a4ebd003d023e202a0066dc4856ce35
- SHA1 faab03610070170c76e837720d909d3f2b7f45e7
- SHA512 b99ea4f2ec5527a32d681506c1070da2df17313392ce4470bff2c2a4e7e8914deb8059619de5d9df923fce900d3b52d89dbaf0117a1b8cc55e154a1ea1aa6ed0
- SSDEEP 1572864:2TSJ3P3R8fNknAnZ2yOogqTcaNH21A/BNNfUcj/xWSaED://h8fNknAnIdA7lxpUcj/xWc
- TLSH
  T1B1D7339E3B8275C2F5AEC27A1505D93FAE71DA0C0B4B447763A418353E272F65A2F630
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2