blankgrabber | e3865fc92281957cd6728875894a25788c4db2cd60a0811da68133c69ff7b668

General

Target
2026-08-15_9f5e2420fe134c06c3bf2a74237dc752_blankgrabber_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar
Size 15.0MB
Sample260815-gagspaz1ct
SHA256 e3865fc92281957cd6728875894a25788c4db2cd60a0811da68133c69ff7b668
MD5 9f5e2420fe134c06c3bf2a74237dc752
SHA1 56aa43216c760409941154a14dbf1eb96c223f23
SHA512 93881f0760700704c479f188259a3f0bd302e13df312aa6fc7e386ce1ef803a4471cb9ae345acaa0aa504305d7ff1cd0d7d663932714aa3d2b82e7fbd6e7b19f
SSDEEP 196608:0WY06BrKwfI9jUCD6rlaZLH7qRGrGIYUoZy8FUsOnAo:IFIH20drLYRZjo
TLSH
T149F633666EC409F5FEAB6438CAD2CB298F337E600394D6CB03649A760F635F04975366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_9f5e2420fe134c06c3bf2a74237dc752_blankgrabber_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom_vidar
- Size 15.0MB
- SHA256 e3865fc92281957cd6728875894a25788c4db2cd60a0811da68133c69ff7b668
- MD5 9f5e2420fe134c06c3bf2a74237dc752
- SHA1 56aa43216c760409941154a14dbf1eb96c223f23
- SHA512 93881f0760700704c479f188259a3f0bd302e13df312aa6fc7e386ce1ef803a4471cb9ae345acaa0aa504305d7ff1cd0d7d663932714aa3d2b82e7fbd6e7b19f
- SSDEEP 196608:0WY06BrKwfI9jUCD6rlaZLH7qRGrGIYUoZy8FUsOnAo:IFIH20drLYRZjo
- TLSH
  T149F633666EC409F5FEAB6438CAD2CB298F337E600394D6CB03649A760F635F04975366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2