General
- Target 2026-07-27_9e730eaa9132acf4d66c3352cbf2724d_blankgrabber_glassworm_icedid_mespinoza_njrat_quasar-rat_ryuk_stealc
- Size 21.5MB
- Sample260727-ldak1azcnb
- SHA256 e5cde06f8ed8e110686387363141237c8f383c159c6d739de2dae30812ab3481
- MD5 9e730eaa9132acf4d66c3352cbf2724d
- SHA1 e6a7b7c4b53b8540ecccee57da537ebd9d1da89a
- SHA512 28c703758a5dc368e98fd1418c8bfb7e23fcb08f5f4f9acf5a910f2267551ba3deecc218f3cec48238d79b372497e2499763cd019f4680e2d84189f5f9811fda
- SSDEEP 393216:DAVPtZHE5U1AQ1CkvK9hrKgYVER5tcorjDF2PHUB2:DGZwrKgYV4zcorjx2PHUB
- TLSH T1ED373B9E845BC3ACC63EE531D06A527B15E4256CF303486BAA0396341E1F9BDBD8C7E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_9e730eaa9132acf4d66c3352cbf2724d_blankgrabber_glassworm_icedid_mespinoza_njrat_quasar-rat_ryuk_stealc.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_9e730eaa9132acf4d66c3352cbf2724d_blankgrabber_glassworm_icedid_mespinoza_njrat_quasar-rat_ryuk_stealc.exe
Resource
win11ltsc2024-20260709-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-27_9e730eaa9132acf4d66c3352cbf2724d_blankgrabber_glassworm_icedid_mespinoza_njrat_quasar-rat_ryuk_stealc
- Size 21.5MB
- SHA256 e5cde06f8ed8e110686387363141237c8f383c159c6d739de2dae30812ab3481
- MD5 9e730eaa9132acf4d66c3352cbf2724d
- SHA1 e6a7b7c4b53b8540ecccee57da537ebd9d1da89a
- SHA512 28c703758a5dc368e98fd1418c8bfb7e23fcb08f5f4f9acf5a910f2267551ba3deecc218f3cec48238d79b372497e2499763cd019f4680e2d84189f5f9811fda
- SSDEEP 393216:DAVPtZHE5U1AQ1CkvK9hrKgYVER5tcorjDF2PHUB2:DGZwrKgYV4zcorjx2PHUB
- TLSH T1ED373B9E845BC3ACC63EE531D06A527B15E4256CF303486BAA0396341E1F9BDBD8C7E4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Enumerates processes with tasklist