General
- Target 2026-08-10_bef452e4773c39d9aaf447600e77d0a4_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz
- Size 111.6MB
- Sample260810-cep8easzg1
- SHA256 79f1127ebab883774d285a8d8d1934b5777b7bc440ee280ed373ab6f0220534f
- MD5 bef452e4773c39d9aaf447600e77d0a4
- SHA1 f5b69f503434bd968ce7b1260c2b837494861571
- SHA512 39bdaf568eaf8f2e3f5871797ee8df1659f04c3c8518149ac8aed9e0c99ccfdc4f39066b056fbdad8a5f102975462ae28afc9dd0c0797afd3e75f2c8d90d9e24
- SSDEEP 1572864:1Pp36F/iKRzDo0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZW:1PpIlDheuXpX/z/5NivOcC7hlTrA
- TLSH T17B48F01663E111AAD577D178C7AB6203EB72B40713308BDB329C43652F73AE45E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_bef452e4773c39d9aaf447600e77d0a4_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_bef452e4773c39d9aaf447600e77d0a4_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_bef452e4773c39d9aaf447600e77d0a4_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz
- Size 111.6MB
- SHA256 79f1127ebab883774d285a8d8d1934b5777b7bc440ee280ed373ab6f0220534f
- MD5 bef452e4773c39d9aaf447600e77d0a4
- SHA1 f5b69f503434bd968ce7b1260c2b837494861571
- SHA512 39bdaf568eaf8f2e3f5871797ee8df1659f04c3c8518149ac8aed9e0c99ccfdc4f39066b056fbdad8a5f102975462ae28afc9dd0c0797afd3e75f2c8d90d9e24
- SSDEEP 1572864:1Pp36F/iKRzDo0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZW:1PpIlDheuXpX/z/5NivOcC7hlTrA
- TLSH T17B48F01663E111AAD577D178C7AB6203EB72B40713308BDB329C43652F73AE45E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE