blankgrabber | fe71449d192157bda269020185fb160de738ccce94827f5cd911a3d3a626ba9f

General

Target
2026-08-13_fd0b79c6d1bc953f34e1d9587c2c2ea3_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 80.0MB
Sample260814-aal9vahn7v
SHA256 fe71449d192157bda269020185fb160de738ccce94827f5cd911a3d3a626ba9f
MD5 fd0b79c6d1bc953f34e1d9587c2c2ea3
SHA1 14faaaaf8821f4829b095a3e7fe9aadd125d09b8
SHA512 c0bc6759e1a240655723d53771aa07ba4721239cb10ab8ca014ec337ee80cc78d837b8a6abba53fbab4531289949853e8c555a68d6c782098c24f6cc0e70a1e5
SSDEEP 196608:JQREzRsj5Ljv+bhqNVoB8Ck5c7GpNlpq41J2ySEnbk9qtlDfJV:ErL+9qz88Ck+7q3p91JmBqfH
TLSH
T19E083394B3900CF1EB3BA23DCA16451DDBB2B9226364C6DB0378A3364F174D59C3AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-13_fd0b79c6d1bc953f34e1d9587c2c2ea3_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 80.0MB
- SHA256 fe71449d192157bda269020185fb160de738ccce94827f5cd911a3d3a626ba9f
- MD5 fd0b79c6d1bc953f34e1d9587c2c2ea3
- SHA1 14faaaaf8821f4829b095a3e7fe9aadd125d09b8
- SHA512 c0bc6759e1a240655723d53771aa07ba4721239cb10ab8ca014ec337ee80cc78d837b8a6abba53fbab4531289949853e8c555a68d6c782098c24f6cc0e70a1e5
- SSDEEP 196608:JQREzRsj5Ljv+bhqNVoB8Ck5c7GpNlpq41J2ySEnbk9qtlDfJV:ErL+9qz88Ck+7q3p91JmBqfH
- TLSH
  T19E083394B3900CF1EB3BA23DCA16451DDBB2B9226364C6DB0378A3364F174D59C3AB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2