Extracted

• • Target
    2026-07-26_4ea56c31e7c6994a21f0173c4d624ce5_blankgrabber_glassworm_icedid_luca-stealer_njrat
  • Size 15.9MB
  • SHA256 6ce3b06155624aa0600182302cc3bda88004595b812d4c70a542f5992bc815a5
  • MD5 4ea56c31e7c6994a21f0173c4d624ce5
  • SHA1 77fb5342dbad7e4d19cd5a7da7991016ac538032
  • SHA512 a81062867395382fafa4b8c232b0426bfd2cdd46896772b6b3b5d53001ce0a2db286e4eb6d679d067ef36533c8a04a9ca5cd22bd67055a5159b7bc10fddb8744
  • SSDEEP 393216:ISn5ZSpQoNPj0OKPvzSFKcIfXMCHWUjgGwp15Qi:NmSy9KPvzuKc+XMb8gZj
  • TLSH
    T1E1F63307735C42EFECA35532B1BA897A9611FC1B4B20C6CB76E4D56E0E174CC1A39AE4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutiondestiny_stealerstealer

  • Family: Destiny Stealer

    DestinyStealer is a stealer written in C#.

    stealerdestiny_stealer

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • NirSoft EdgeCookiesView

    Password recovery tool for Microsoft Edge browser

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2