35606deec0544cc4fbf99855f7debb9a40d678af8a46e9fcad8373dddb5ba093

General

Target
2026-07-24_0ae8ead747f5d6fe93c075ec2cd465de_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 60.8MB
Sample260724-lnxtaaxbqh
SHA256 35606deec0544cc4fbf99855f7debb9a40d678af8a46e9fcad8373dddb5ba093
MD5 0ae8ead747f5d6fe93c075ec2cd465de
SHA1 c7b92a88dae777f2135043b053ce74c8b571e8d9
SHA512 8974e16d4da3b966a193d6cbfda87fe544de254e45d3524f1703e0cf705a64a05348ff7c71102360fafbf3ac6db5d369d2d00cf3dd1a1e52bbf8006932d0d666
SSDEEP 1572864:aTSJ3P3R8fNknAnZ2yOogqTcaNH21A/BNNfUcj/xWSaED:T/h8fNknAnIdA7lxpUcj/xWc
TLSH
T1F9D7339E3B8275C2F5AEC27A1505D93FAE71DA0C0B4B447763A418353E272F65A2F630
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-24_0ae8ead747f5d6fe93c075ec2cd465de_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 60.8MB
- SHA256 35606deec0544cc4fbf99855f7debb9a40d678af8a46e9fcad8373dddb5ba093
- MD5 0ae8ead747f5d6fe93c075ec2cd465de
- SHA1 c7b92a88dae777f2135043b053ce74c8b571e8d9
- SHA512 8974e16d4da3b966a193d6cbfda87fe544de254e45d3524f1703e0cf705a64a05348ff7c71102360fafbf3ac6db5d369d2d00cf3dd1a1e52bbf8006932d0d666
- SSDEEP 1572864:aTSJ3P3R8fNknAnZ2yOogqTcaNH21A/BNNfUcj/xWSaED:T/h8fNknAnIdA7lxpUcj/xWc
- TLSH
  T1F9D7339E3B8275C2F5AEC27A1505D93FAE71DA0C0B4B447763A418353E272F65A2F630
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2