General
- Target 2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz
- Size 57.4MB
- Sample260723-py4lcscp9v
- SHA256 805b9a1b47d39be1303035c6052330d18e6ff311cba6d986917722d40f489eee
- MD5 cc3ae793a891be8dd8defed199446600
- SHA1 bdba0f606d2adaa66a0de7a3635eafb3091104ff
- SHA512 ae8b553461ce5aae4c767660831b2e7b7d5be651c72203eb5a9f2278bd1ca700185b9e7d2bbff2bf0715c454cb3918752949b687be837195680a1812dbab7e83
- SSDEEP 393216:d2PB+xzPvG3TnPgUKD2OVwWOHectHHWLJoTG4Q42WA26Xz6hg1V24kfpslIDomYx:4PpvHWa6F/i2zSfgpe1k4mPddGVUOmp
- TLSH T188D7AD1663A111AAD577D178CBAB6203EB72B40713308BDB329C43652F63BE45E7BB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
6 signatures
Behavioral task
behavioral1
Sample
2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz
- Size 57.4MB
- SHA256 805b9a1b47d39be1303035c6052330d18e6ff311cba6d986917722d40f489eee
- MD5 cc3ae793a891be8dd8defed199446600
- SHA1 bdba0f606d2adaa66a0de7a3635eafb3091104ff
- SHA512 ae8b553461ce5aae4c767660831b2e7b7d5be651c72203eb5a9f2278bd1ca700185b9e7d2bbff2bf0715c454cb3918752949b687be837195680a1812dbab7e83
- SSDEEP 393216:d2PB+xzPvG3TnPgUKD2OVwWOHectHHWLJoTG4Q42WA26Xz6hg1V24kfpslIDomYx:4PpvHWa6F/i2zSfgpe1k4mPddGVUOmp
- TLSH T188D7AD1663A111AAD577D178CBAB6203EB72B40713308BDB329C43652F63BE45E7BB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.