General
- Target 2026-07-31_b30e4575ff769ac67f2e353e12e7e074_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 18.9MB
- Sample260801-bpph7avclb
- SHA256 2d789494f98212b7395b7618e722773ed9e462237047c27e0fb7e0845d340899
- MD5 b30e4575ff769ac67f2e353e12e7e074
- SHA1 9b90bea72aab9ccaca6edf5f9dc35530aadb472e
- SHA512 e05a4b74b07318d4c95e8b159c8fc71254fe08339076ed1dc75d774c0311a3ac88f6563c58db9f9697d438f624d479b2d97a47917548991cbc78ca425096661b
- SSDEEP 393216:qF+ldV276SsRzXFMuVFLMGMCMw1r+8ADtAigoGax0asQpBa13eDX2BpABC:7ljSYGubvMCMw1LgtAiXGaxeQPQ3eKBa
- TLSH T1821733088B91D9CFFAB9063C5D71FA2981F371C21BB582BB07A511CB1A1BEC50D7A563
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-07-31_b30e4575ff769ac67f2e353e12e7e074_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_b30e4575ff769ac67f2e353e12e7e074_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_b30e4575ff769ac67f2e353e12e7e074_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 18.9MB
- SHA256 2d789494f98212b7395b7618e722773ed9e462237047c27e0fb7e0845d340899
- MD5 b30e4575ff769ac67f2e353e12e7e074
- SHA1 9b90bea72aab9ccaca6edf5f9dc35530aadb472e
- SHA512 e05a4b74b07318d4c95e8b159c8fc71254fe08339076ed1dc75d774c0311a3ac88f6563c58db9f9697d438f624d479b2d97a47917548991cbc78ca425096661b
- SSDEEP 393216:qF+ldV276SsRzXFMuVFLMGMCMw1r+8ADtAigoGax0asQpBa13eDX2BpABC:7ljSYGubvMCMw1LgtAiXGaxeQPQ3eKBa
- TLSH T1821733088B91D9CFFAB9063C5D71FA2981F371C21BB582BB07A511CB1A1BEC50D7A563
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.