General
- Target 2026-08-19_359b2d24ea129f191930bbd36b2d2843_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz
- Size 111.5MB
- Sample260819-grpjvsxhnd
- SHA256 1d3e972dc9799383d55ccef92cdd807a6e9936d06811e055fcd2cb21dc6f1109
- MD5 359b2d24ea129f191930bbd36b2d2843
- SHA1 ab35d0086c6bb73372bdb5f56ca64aa00f38fb5b
- SHA512 6220552f47534e39cdc6f0bdf5f2177d4033ed00d432b9d87b0a8e340f7cbd38be873494851895c87937ab2673958f6a35036242eb2a6b5d2a2ae4dc6d196d62
- SSDEEP 1572864:1Pp36F/iKRz/o0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZr:1PpIl/heuXpX/z/5NivOcC7hlTr5
- TLSH T12248F01663E111AAD577D138C7AB6603EB72B40713308BDB329C43652F63AE45E7BB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_359b2d24ea129f191930bbd36b2d2843_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_359b2d24ea129f191930bbd36b2d2843_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_359b2d24ea129f191930bbd36b2d2843_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz
- Size 111.5MB
- SHA256 1d3e972dc9799383d55ccef92cdd807a6e9936d06811e055fcd2cb21dc6f1109
- MD5 359b2d24ea129f191930bbd36b2d2843
- SHA1 ab35d0086c6bb73372bdb5f56ca64aa00f38fb5b
- SHA512 6220552f47534e39cdc6f0bdf5f2177d4033ed00d432b9d87b0a8e340f7cbd38be873494851895c87937ab2673958f6a35036242eb2a6b5d2a2ae4dc6d196d62
- SSDEEP 1572864:1Pp36F/iKRz/o0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZr:1PpIl/heuXpX/z/5NivOcC7hlTr5
- TLSH T12248F01663E111AAD577D138C7AB6603EB72B40713308BDB329C43652F63AE45E7BB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE