blankgrabber | 9cf95930b554055d59f608d3d5226987ffdba5670f27a38ab9e10b430152ecc2

General

Target
2026-08-18_a160a7e301544da082eb9409ec60f2ef_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 18.4MB
Sample260818-cerfgavsdt
SHA256 9cf95930b554055d59f608d3d5226987ffdba5670f27a38ab9e10b430152ecc2
MD5 a160a7e301544da082eb9409ec60f2ef
SHA1 35386a979c1ccf91c508c7f0da31237297418423
SHA512 effba9ffb16c7bc0cca208933988e89e02826bcc75d006d593860b70295ba55c81909bd767a9f1e8b42f9e5264bac4d893ddabf30069a3f9c1301acbcb436352
SSDEEP 393216:+PLiNEJUMO6wNto3KDGoZYJv+KDt85w84fsekfxb+qoy1PZ/woDW1kyH:+ziNZrFEKDGPgCsxbGEPhwoDW1P
TLSH
T1B617334D5BA11AFBD9C2857ECE638936637BFD400F90C2CB022407255E675E15EAE33A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-18_a160a7e301544da082eb9409ec60f2ef_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 18.4MB
- SHA256 9cf95930b554055d59f608d3d5226987ffdba5670f27a38ab9e10b430152ecc2
- MD5 a160a7e301544da082eb9409ec60f2ef
- SHA1 35386a979c1ccf91c508c7f0da31237297418423
- SHA512 effba9ffb16c7bc0cca208933988e89e02826bcc75d006d593860b70295ba55c81909bd767a9f1e8b42f9e5264bac4d893ddabf30069a3f9c1301acbcb436352
- SSDEEP 393216:+PLiNEJUMO6wNto3KDGoZYJv+KDt85w84fsekfxb+qoy1PZ/woDW1kyH:+ziNZrFEKDGPgCsxbGEPhwoDW1P
- TLSH
  T1B617334D5BA11AFBD9C2857ECE638936637BFD400F90C2CB022407255E675E15EAE33A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution pyinstaller upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2