General
- Target 2026-07-24_e9e2dcf03f19935a2e01c379cf0f140f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz
- Size 47.7MB
- Sample260724-a2bx7adh78
- SHA256 c2dd71a5440385df6cf70dda34f3ba03fcdad8eff52feec8bd90370d88ffd316
- MD5 e9e2dcf03f19935a2e01c379cf0f140f
- SHA1 1050488301584d1e09991ec2fbfe86c2ae38a41b
- SHA512 3ef855ab5208cf14cc6f2d7c847ba3a53186a92451a23b13a4178bd6786cb7f024d07f12827d4c9510da64a9037f50f9c31669e6eefe427785bcde78a2e9ad1c
- SSDEEP 393216:AzBd4IcVUnN7qg+21j++sHV1KX6RSF32YhQSI8w5SvDazn1d5VR/6Lgc/icMOQMj:AaW1JhQlR7TtKeagPV1imrEh
- TLSH T17DB7AD0673E406AAE577D138CAA68107F7B3B4161730C7DB329C03692F6BAE45E7A750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-24_e9e2dcf03f19935a2e01c379cf0f140f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-24_e9e2dcf03f19935a2e01c379cf0f140f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-24_e9e2dcf03f19935a2e01c379cf0f140f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz
- Size 47.7MB
- SHA256 c2dd71a5440385df6cf70dda34f3ba03fcdad8eff52feec8bd90370d88ffd316
- MD5 e9e2dcf03f19935a2e01c379cf0f140f
- SHA1 1050488301584d1e09991ec2fbfe86c2ae38a41b
- SHA512 3ef855ab5208cf14cc6f2d7c847ba3a53186a92451a23b13a4178bd6786cb7f024d07f12827d4c9510da64a9037f50f9c31669e6eefe427785bcde78a2e9ad1c
- SSDEEP 393216:AzBd4IcVUnN7qg+21j++sHV1KX6RSF32YhQSI8w5SvDazn1d5VR/6Lgc/icMOQMj:AaW1JhQlR7TtKeagPV1imrEh
- TLSH T17DB7AD0673E406AAE577D138CAA68107F7B3B4161730C7DB329C03692F6BAE45E7A750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.