Overview

overview

10

Static

static

3

2026-07-19...at.exe

windows10-2004-x64

10

2026-07-19...at.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-07-19_87950cd5820bf5e778ce8e86d0a7143f_blankgrabber_glassworm_icedid_luca-stealer_njrat
  • Size 97.0MB
  • Sample260720-bfkhwadv6v
  • SHA256 53d52d184f5fc53ef915e747d927a93be523d0adcf2ce905057fc4ad03638ac7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
pyinstallerransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\_MEI35442\config.txt

Ransom Note
  • Payment Code: 123 Secret Code: 123 Timer Duration: 168 hours Start on Startup: True Close on Alt: False Ransom Note: All your files have been encrypted with Vortex Tools Ransomware! any damage is not done by me. Your documents, photos, databases, and other important files have been locked with our unique encryption. To get your files back, you must pay 5 EURO to the following Address: 123 After payment, send an email to Useful [email protected] with your payment ID and you will receive the decryption key. If you do not pay within 7 days, your files will be permanently lost. Any attempt to modify or delete the encrypted files will result in permanent data loss. EDUCATIONAL PURPOSE ONLY - This is a simulation, not real ransomware

Targets

    • Target
      2026-07-19_87950cd5820bf5e778ce8e86d0a7143f_blankgrabber_glassworm_icedid_luca-stealer_njrat
    • Size 97.0MB
    • SHA256 53d52d184f5fc53ef915e747d927a93be523d0adcf2ce905057fc4ad03638ac7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    ransomwarespywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks