General
- Target 2026-07-29_78980b6cc337dff86c852432ffb1b148_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc
- Size 9.2MB
- Sample260729-c63mtasgkd
- SHA256 394383ead225c23853593804e9a21f250336b3883b2928755518574f9920b3f2
- MD5 78980b6cc337dff86c852432ffb1b148
- SHA1 65a8949a269ceb9568dbbf1daeb5be532a521173
- SHA512 d4884db817ae469056fc9298a5c171448b77c1e948efe6033ee28c0725994e550a15801ac3b27ee5e4e3d557b68d6f8ff74c3463a7df195185269dca783ffe57
- SSDEEP 196608:2+1G7bsk0EKkgmXqdQQ8aGkc47Ram7U0UB:2+1Obsk0EKkLXc8aGkc47Ram7A
- TLSH T1FCA68C15E77800D8E4AAC1B9C7465157D7B1784A03B0ABDF1A90AEF62F27AE41F3B701
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
6 signatures
Behavioral task
behavioral1
Sample
2026-07-29_78980b6cc337dff86c852432ffb1b148_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-29_78980b6cc337dff86c852432ffb1b148_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc
- Size 9.2MB
- SHA256 394383ead225c23853593804e9a21f250336b3883b2928755518574f9920b3f2
- MD5 78980b6cc337dff86c852432ffb1b148
- SHA1 65a8949a269ceb9568dbbf1daeb5be532a521173
- SHA512 d4884db817ae469056fc9298a5c171448b77c1e948efe6033ee28c0725994e550a15801ac3b27ee5e4e3d557b68d6f8ff74c3463a7df195185269dca783ffe57
- SSDEEP 196608:2+1G7bsk0EKkgmXqdQQ8aGkc47Ram7U0UB:2+1Obsk0EKkLXc8aGkc47Ram7A
- TLSH T1FCA68C15E77800D8E4AAC1B9C7465157D7B1784A03B0ABDF1A90AEF62F27AE41F3B701
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1