blankgrabber | 2f18b9171e7ed7d682771f3dcf0d6819ee01d366b167456ffb71246dc19d4142

General

Target
2026-08-19_0e1d5f8edfaf0e92e6dcf93930ba91b2_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 35.0MB
Sample260819-3bqymswanf
SHA256 2f18b9171e7ed7d682771f3dcf0d6819ee01d366b167456ffb71246dc19d4142
MD5 0e1d5f8edfaf0e92e6dcf93930ba91b2
SHA1 dfcd08e1dbd76320fa374da9a35398cf56e9fb86
SHA512 0c2ad01f0310cb2805573c0c3623c11d48ef3a19107908c7e3bfb01ee0e0380978d28e8e2cb90cea606227eaba77ad150449e27abe85bdb899584ec36d516f6f
SSDEEP 196608:kWumWAOjmFwDRxtYSHdK3Hkdai7bN3m2G8MneJ:YvK2pMEB3QK
TLSH
T125873344230219F5E5FB123D8C928059E4B674066740CBDFC3B886A55F27AF16F7BBA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-19_0e1d5f8edfaf0e92e6dcf93930ba91b2_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 35.0MB
- SHA256 2f18b9171e7ed7d682771f3dcf0d6819ee01d366b167456ffb71246dc19d4142
- MD5 0e1d5f8edfaf0e92e6dcf93930ba91b2
- SHA1 dfcd08e1dbd76320fa374da9a35398cf56e9fb86
- SHA512 0c2ad01f0310cb2805573c0c3623c11d48ef3a19107908c7e3bfb01ee0e0380978d28e8e2cb90cea606227eaba77ad150449e27abe85bdb899584ec36d516f6f
- SSDEEP 196608:kWumWAOjmFwDRxtYSHdK3Hkdai7bN3m2G8MneJ:YvK2pMEB3QK
- TLSH
  T125873344230219F5E5FB123D8C928059E4B674066740CBDFC3B886A55F27AF16F7BBA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2