50381c524ca529b1b186c4a2aa15a9aa4c835e05dafac823bb3df038d8ef32b4

General

Target
2026-08-04_8afa27454911c09affbf2005fbe62b53_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 60.8MB
Sample260804-sfxa4shj3v
SHA256 50381c524ca529b1b186c4a2aa15a9aa4c835e05dafac823bb3df038d8ef32b4
MD5 8afa27454911c09affbf2005fbe62b53
SHA1 84d4f9328493d091487248a24e2fa59fae846a68
SHA512 a67504f502533c20d55f0f3fa0e6a88c47688fd74452de2c632905726be733f69113283bca30d443dc2abb1cc7357b7a0cb0ea1fd8b4e8d9a7dddcffb5915b67
SSDEEP 1572864:jTSJ3P3R8fNknAnZ2yOogqTcaNH21A/BNNfUcj/xWSaED:g/h8fNknAnIdA7lxpUcj/xWc
TLSH
T153D7339E3B8275C2F5AEC27A1505D93FAE71DA0C0B4B447763A418353E272F65A2F630
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-04_8afa27454911c09affbf2005fbe62b53_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 60.8MB
- SHA256 50381c524ca529b1b186c4a2aa15a9aa4c835e05dafac823bb3df038d8ef32b4
- MD5 8afa27454911c09affbf2005fbe62b53
- SHA1 84d4f9328493d091487248a24e2fa59fae846a68
- SHA512 a67504f502533c20d55f0f3fa0e6a88c47688fd74452de2c632905726be733f69113283bca30d443dc2abb1cc7357b7a0cb0ea1fd8b4e8d9a7dddcffb5915b67
- SSDEEP 1572864:jTSJ3P3R8fNknAnZ2yOogqTcaNH21A/BNNfUcj/xWSaED:g/h8fNknAnIdA7lxpUcj/xWc
- TLSH
  T153D7339E3B8275C2F5AEC27A1505D93FAE71DA0C0B4B447763A418353E272F65A2F630
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2