General
- Target 2026-07-29_6ac27b630647499b1ad2abc9813a9be8_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc
- Size 9.2MB
- Sample260729-c74w9sfl61
- SHA256 1e93bcfa0bb8353e8fe8625bad6323c91b494d9f960dea6bf6f3d229fdc958c8
- MD5 6ac27b630647499b1ad2abc9813a9be8
- SHA1 8012adbb727f5d18107c43af353e3558ba7194b3
- SHA512 0c597238461732d7ba24f3a69399f9d743903dca20b26c209c7fa1c7e9a9ee8648811e68a5875d09a1b58c498452fed4ca7915bcb7317a8bd40772ca773a637d
- SSDEEP 196608:4+1G7bsk0EKkgmXqdQQ8aGkc47Ram7U0UB:4+1Obsk0EKkLXc8aGkc47Ram7A
- TLSH T1FFA68C15E77800D8E4AAC1B9C7465157D7B1784A03B0ABDF1A90AEF62F27AE41F3B701
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
6 signatures
Behavioral task
behavioral1
Sample
2026-07-29_6ac27b630647499b1ad2abc9813a9be8_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-29_6ac27b630647499b1ad2abc9813a9be8_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc
- Size 9.2MB
- SHA256 1e93bcfa0bb8353e8fe8625bad6323c91b494d9f960dea6bf6f3d229fdc958c8
- MD5 6ac27b630647499b1ad2abc9813a9be8
- SHA1 8012adbb727f5d18107c43af353e3558ba7194b3
- SHA512 0c597238461732d7ba24f3a69399f9d743903dca20b26c209c7fa1c7e9a9ee8648811e68a5875d09a1b58c498452fed4ca7915bcb7317a8bd40772ca773a637d
- SSDEEP 196608:4+1G7bsk0EKkgmXqdQQ8aGkc47Ram7U0UB:4+1Obsk0EKkLXc8aGkc47Ram7A
- TLSH T1FFA68C15E77800D8E4AAC1B9C7465157D7B1784A03B0ABDF1A90AEF62F27AE41F3B701
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks for any installed AV software in registry
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1