General
- Target 2026-07-23_7023e0155979cb92699d7e48ad3e8595_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 27.9MB
- Sample260723-21415aydjd
- SHA256 74bee00ab2672ff99b7e5f3ef1ed05e25de637e150c710ae2dd8f71e36f962f9
- MD5 7023e0155979cb92699d7e48ad3e8595
- SHA1 4591695d1f3fcbfbb089fef2c19af95d4ccc2931
- SHA512 d42268af98ab5c19a02bee92f5fb9d255d6782f0f1fba3b5cede303d78abc39b783f2b1b5db9e631b92f152a757ab0e7060c6644727f6f0925a574e71d2e1352
- SSDEEP 786432:gwMxUFVlpjE9b1AyXSnzYV8TjjVIoJ1qp7rYtZq5Xwt7el:g3UjT49Sa8bVIobqp7rYDq5XwNY
- TLSH T1D7573329DBC029BBD453E239DB63D9A1F361B1463B169DFF0A91035E1F6BA50443E28C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Behavioral task
behavioral1
Sample
2026-07-23_7023e0155979cb92699d7e48ad3e8595_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_7023e0155979cb92699d7e48ad3e8595_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260710-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_7023e0155979cb92699d7e48ad3e8595_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 27.9MB
- SHA256 74bee00ab2672ff99b7e5f3ef1ed05e25de637e150c710ae2dd8f71e36f962f9
- MD5 7023e0155979cb92699d7e48ad3e8595
- SHA1 4591695d1f3fcbfbb089fef2c19af95d4ccc2931
- SHA512 d42268af98ab5c19a02bee92f5fb9d255d6782f0f1fba3b5cede303d78abc39b783f2b1b5db9e631b92f152a757ab0e7060c6644727f6f0925a574e71d2e1352
- SSDEEP 786432:gwMxUFVlpjE9b1AyXSnzYV8TjjVIoJ1qp7rYtZq5Xwt7el:g3UjT49Sa8bVIobqp7rYDq5XwNY
- TLSH T1D7573329DBC029BBD453E239DB63D9A1F361B1463B169DFF0A91035E1F6BA50443E28C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables (downlaoders) containing URLs to raw contents of a paste
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.