General
- Target 2026-07-22_b06af8a4ae9b3291cbd66970c63362ad_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz
- Size 47.7MB
- Sample260722-vrrk4sdn2w
- SHA256 0188d69d245e2b143858674e1d5814934c9a19c0ccccb02a28aa39bdbd854c23
- MD5 b06af8a4ae9b3291cbd66970c63362ad
- SHA1 437b847219d0a142224c7d0e08a107918ce2a677
- SHA512 b0d2144d87c934c7997addb0a9bc7458f466a9726ebf86bdfd56c95c75689ca4dad40913f5413f4357aaee55d2b8b8ab3fb4a4b2ad8880f50ccbdbc404ebb433
- SSDEEP 393216:AzBd4IcVUnN7qg+21j++sHV1KX6RSF32YhQSI8w5SvDazn1d5VR/6Lgc/icMOQMv:AaW1JhQlR7TtKeagPV1EmM/j
- TLSH T19DB7AD0673E406AAE577D138CAA68107F7B3B4161730C7DB329C03692F6BAE45E7A750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-22_b06af8a4ae9b3291cbd66970c63362ad_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_b06af8a4ae9b3291cbd66970c63362ad_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-22_b06af8a4ae9b3291cbd66970c63362ad_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz
- Size 47.7MB
- SHA256 0188d69d245e2b143858674e1d5814934c9a19c0ccccb02a28aa39bdbd854c23
- MD5 b06af8a4ae9b3291cbd66970c63362ad
- SHA1 437b847219d0a142224c7d0e08a107918ce2a677
- SHA512 b0d2144d87c934c7997addb0a9bc7458f466a9726ebf86bdfd56c95c75689ca4dad40913f5413f4357aaee55d2b8b8ab3fb4a4b2ad8880f50ccbdbc404ebb433
- SSDEEP 393216:AzBd4IcVUnN7qg+21j++sHV1KX6RSF32YhQSI8w5SvDazn1d5VR/6Lgc/icMOQMv:AaW1JhQlR7TtKeagPV1EmM/j
- TLSH T19DB7AD0673E406AAE577D138CAA68107F7B3B4161730C7DB329C03692F6BAE45E7A750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.