c86a7ce6669d21d2976f5e5b76bbca23b23b1a107fc95d0638383acf36bee138

General

Target
2026-08-14_8d0558680575201d5dcc1de4a67894d8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz
Size 122.2MB
Sample260815-csxjmsxbpg
SHA256 c86a7ce6669d21d2976f5e5b76bbca23b23b1a107fc95d0638383acf36bee138
MD5 8d0558680575201d5dcc1de4a67894d8
SHA1 94162b2e71c91a25b8245531d33e174685c7ca6a
SHA512 8805551317e8893883f4be575db47e9d4393ac4587ade32c6e1ae6117a8ae84d0242215a6b3bd09c860b689f3eadf005f2685a633c3b0b888517ab5ebbef4e1a
SSDEEP 1572864:a6zuLINumgj6iQfBZArpi1laVsxzKiZ63lH89a9cePSJ/vKeYw:a6zcmgmzBa1i1lAsxN+Jua9RSJSK
TLSH
T17358F11663E111AAD577D178C7AB6203EB72B40B13308BDF329C43652F63AE45E7A760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-08-14_8d0558680575201d5dcc1de4a67894d8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz
- Size 122.2MB
- SHA256 c86a7ce6669d21d2976f5e5b76bbca23b23b1a107fc95d0638383acf36bee138
- MD5 8d0558680575201d5dcc1de4a67894d8
- SHA1 94162b2e71c91a25b8245531d33e174685c7ca6a
- SHA512 8805551317e8893883f4be575db47e9d4393ac4587ade32c6e1ae6117a8ae84d0242215a6b3bd09c860b689f3eadf005f2685a633c3b0b888517ab5ebbef4e1a
- SSDEEP 1572864:a6zuLINumgj6iQfBZArpi1laVsxzKiZ63lH89a9cePSJ/vKeYw:a6zcmgmzBa1i1lAsxN+Jua9RSJSK
- TLSH
  T17358F11663E111AAD577D178C7AB6203EB72B40B13308BDF329C43652F63AE45E7A760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence spyware stealer
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2