blankgrabber | 8670c7918d5407efaced3eaf8467a9a80569ec0a1fea34429a224ba7b43113f6

General

Target
2026-08-12_e20750186c272dff0d8f425ffc290d57_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 13.0MB
Sample260812-ezh1yavyc1
SHA256 8670c7918d5407efaced3eaf8467a9a80569ec0a1fea34429a224ba7b43113f6
MD5 e20750186c272dff0d8f425ffc290d57
SHA1 30d747aaa62bca72b550b3af53a988f7b475eab5
SHA512 7abcbd15e2d38bdc7fa06610bf33eb748713cdf6312654ba5096df1fb59462057499dc64ffec708f2f80334169c9d44a5c8b9cd98e0fe703bce970a7a1237e47
SSDEEP 196608:LuqYS6tOshoKMuIkhVastRL5Di3uq1D7m+:XYS2OshouIkPftRL54DRX
TLSH
T1CCD63311B3A558EAF981D23EC5C6C625DB33399113E0D58B07A847B21F272AE4C3AF57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-12_e20750186c272dff0d8f425ffc290d57_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 13.0MB
- SHA256 8670c7918d5407efaced3eaf8467a9a80569ec0a1fea34429a224ba7b43113f6
- MD5 e20750186c272dff0d8f425ffc290d57
- SHA1 30d747aaa62bca72b550b3af53a988f7b475eab5
- SHA512 7abcbd15e2d38bdc7fa06610bf33eb748713cdf6312654ba5096df1fb59462057499dc64ffec708f2f80334169c9d44a5c8b9cd98e0fe703bce970a7a1237e47
- SSDEEP 196608:LuqYS6tOshoKMuIkhVastRL5Di3uq1D7m+:XYS2OshouIkPftRL54DRX
- TLSH
  T1CCD63311B3A558EAF981D23EC5C6C625DB33399113E0D58B07A847B21F272AE4C3AF57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2