General
- Target 2026-08-05_d9eb5cba217c2ec4d6335243d6dadddc_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 67.6MB
- Sample260805-lsfessvanf
- SHA256 92539d8fa751a5c280725b00cc56b5b6da1fb8f9c8695b3e1a803f74faf6c866
Score
10/10
Malware Config
Targets
-
- Target 2026-08-05_d9eb5cba217c2ec4d6335243d6dadddc_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 67.6MB
- SHA256 92539d8fa751a5c280725b00cc56b5b6da1fb8f9c8695b3e1a803f74faf6c866
Score9/10-
Detects executables packed with Themida
-
Detects executables referencing many IR and analysis tools
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Modifies boot configuration data using bcdedit
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Virtualization/Sandbox Evasion
1