blankgrabber | 778741070ae24d96d60538ba1e162d9a7f8137b873b9cd479de763fca1daf241

General

Target
2026-08-15_de67cd86c961b978191f769c1182d01c_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 12.0MB
Sample260815-bfa97scn5y
SHA256 778741070ae24d96d60538ba1e162d9a7f8137b873b9cd479de763fca1daf241
MD5 de67cd86c961b978191f769c1182d01c
SHA1 219bcb41b8f2c4431cf7419aa944ed7d8e0ee4c3
SHA512 8e06fbd70622e955f8ac973deeb763f32afb1b5dfbaabca2f350fe0dc4b17b79238ae51b9b71ed0044e5c96f047b8c40ed978b7ed070f6d3114720fe2699480e
SSDEEP 196608:oWy06oGyFBwfI9jUCD6rlaZLH7qRGrGIYUoZy8FUsOnAoW:XbAIH20drLYRZjoW
TLSH
T1BCC63366ADC009F5F9BB1139C9D38A298F337E5413A4DADB03649BAB0F530F14936366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_de67cd86c961b978191f769c1182d01c_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 12.0MB
- SHA256 778741070ae24d96d60538ba1e162d9a7f8137b873b9cd479de763fca1daf241
- MD5 de67cd86c961b978191f769c1182d01c
- SHA1 219bcb41b8f2c4431cf7419aa944ed7d8e0ee4c3
- SHA512 8e06fbd70622e955f8ac973deeb763f32afb1b5dfbaabca2f350fe0dc4b17b79238ae51b9b71ed0044e5c96f047b8c40ed978b7ed070f6d3114720fe2699480e
- SSDEEP 196608:oWy06oGyFBwfI9jUCD6rlaZLH7qRGrGIYUoZy8FUsOnAoW:XbAIH20drLYRZjoW
- TLSH
  T1BCC63366ADC009F5F9BB1139C9D38A298F337E5413A4DADB03649BAB0F530F14936366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2