368275cedfd4bfed2dd7612304fc8c5a6f708eea0cefe22d7a967f70e655a97a

General

Target
2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 60.8MB
Sample260722-1ckrxace85
SHA256 368275cedfd4bfed2dd7612304fc8c5a6f708eea0cefe22d7a967f70e655a97a
MD5 0225bb91b51ed8e4f3eeaea8c07bddff
SHA1 69e5183d0b7c1ead8df8a1e83551172c7cb1c5fb
SHA512 c7501cf3d39aa51a84f678f26400de047c8110e9e1ee070c2e303de54f6ff1a2ae5ca61e3137765449ac3df83f5d6b87879872348f0dd6d45bc5619948a936dd
SSDEEP 1572864:2TSJ3P3R8fNknAnZ2yOogqTcaNH21A/BNNfUcj/xWSaED://h8fNknAnIdA7lxpUcj/xWc
TLSH
T19AD7339E3B8275C2F5AEC27A1505D93FAE71DA0C0B4B447763A418353E272F65A2F630
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-22_0225bb91b51ed8e4f3eeaea8c07bddff_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 60.8MB
- SHA256 368275cedfd4bfed2dd7612304fc8c5a6f708eea0cefe22d7a967f70e655a97a
- MD5 0225bb91b51ed8e4f3eeaea8c07bddff
- SHA1 69e5183d0b7c1ead8df8a1e83551172c7cb1c5fb
- SHA512 c7501cf3d39aa51a84f678f26400de047c8110e9e1ee070c2e303de54f6ff1a2ae5ca61e3137765449ac3df83f5d6b87879872348f0dd6d45bc5619948a936dd
- SSDEEP 1572864:2TSJ3P3R8fNknAnZ2yOogqTcaNH21A/BNNfUcj/xWSaED://h8fNknAnIdA7lxpUcj/xWc
- TLSH
  T19AD7339E3B8275C2F5AEC27A1505D93FAE71DA0C0B4B447763A418353E272F65A2F630
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2