blankgrabber | 9ab52dd4c1e87922d59f4820ec4c5b5b98d45ad3e513a6712b0493714db8043c

General

Target
2026-08-20_a6c4a0ddbf7c1dac1d2a49cc004f1b99_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 8.2MB
Sample260820-bgdfyscp71
SHA256 9ab52dd4c1e87922d59f4820ec4c5b5b98d45ad3e513a6712b0493714db8043c
MD5 a6c4a0ddbf7c1dac1d2a49cc004f1b99
SHA1 c7c100cc025a0773dccc0919b386d7204fd1086e
SHA512 7487acccd51ffd14d02bae3ac136d108336efe7d254ba8413ba34109dfa9327dd25c153c62983ef8e82e08cd317b5532f7a3fb5e372ed0744d5c882c232c03a8
SSDEEP 98304:1USinsV2LbVDA2urErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJochTntOEO:ZAurErvI9pWjgfPvzm6gsPEE2EL6z
TLSH
T1759633A263680579E0BB013D8567D107EBB37CA617A086EF07E063522F077F58E36766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-20_a6c4a0ddbf7c1dac1d2a49cc004f1b99_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 8.2MB
- SHA256 9ab52dd4c1e87922d59f4820ec4c5b5b98d45ad3e513a6712b0493714db8043c
- MD5 a6c4a0ddbf7c1dac1d2a49cc004f1b99
- SHA1 c7c100cc025a0773dccc0919b386d7204fd1086e
- SHA512 7487acccd51ffd14d02bae3ac136d108336efe7d254ba8413ba34109dfa9327dd25c153c62983ef8e82e08cd317b5532f7a3fb5e372ed0744d5c882c232c03a8
- SSDEEP 98304:1USinsV2LbVDA2urErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJochTntOEO:ZAurErvI9pWjgfPvzm6gsPEE2EL6z
- TLSH
  T1759633A263680579E0BB013D8567D107EBB37CA617A086EF07E063522F077F58E36766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2