6ac5993c1589b3c9bc65fc58164bc83a9b6aeac265672cfe635a3c92be5924bf

General

Target
2026-08-20_228498febdce554f4f5aed44ed8009f3_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 29.0MB
Sample260820-dp7qwabb66
SHA256 6ac5993c1589b3c9bc65fc58164bc83a9b6aeac265672cfe635a3c92be5924bf
MD5 228498febdce554f4f5aed44ed8009f3
SHA1 296e97e50b707181ac91d39d19d6a7c70fe91b73
SHA512 c2244ef30290054efa5136e86639b39ce7431de6f15f778af5e3588ccadd34a9dd1258666fa602f467961c679f1b5e7ba37032982dfb1db98bbb12a4389a505f
SSDEEP 786432:9oS/d/KnKFoFlUR1OlLVSXiE53CMxRBayTcIaxjBfm6i7AGgW:9oy/DoEWeRCxGtwvWgW
TLSH
T18067339D93488962F5F31AB74C6B97104A37BC904781C79742E8A36C3FB31622D79B39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-20_228498febdce554f4f5aed44ed8009f3_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 29.0MB
- SHA256 6ac5993c1589b3c9bc65fc58164bc83a9b6aeac265672cfe635a3c92be5924bf
- MD5 228498febdce554f4f5aed44ed8009f3
- SHA1 296e97e50b707181ac91d39d19d6a7c70fe91b73
- SHA512 c2244ef30290054efa5136e86639b39ce7431de6f15f778af5e3588ccadd34a9dd1258666fa602f467961c679f1b5e7ba37032982dfb1db98bbb12a4389a505f
- SSDEEP 786432:9oS/d/KnKFoFlUR1OlLVSXiE53CMxRBayTcIaxjBfm6i7AGgW:9oy/DoEWeRCxGtwvWgW
- TLSH
  T18067339D93488962F5F31AB74C6B97104A37BC904781C79742E8A36C3FB31622D79B39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer trojan upx
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2