blankgrabber | 6723578fe50e2cef1e08fe5c620d9d6ce64960c0a3aeaffdf60c2ceb7decf458

General

Target
2026-08-20_43b4e9e41a871378960fb8f678258d15_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 10.1MB
Sample260820-s3rddatvb1
SHA256 6723578fe50e2cef1e08fe5c620d9d6ce64960c0a3aeaffdf60c2ceb7decf458
MD5 43b4e9e41a871378960fb8f678258d15
SHA1 0d32bc0df0854bceeaa28c55bd466a121f236934
SHA512 e7ac2603677206168581a5ecfb99a4b63efd3edc9c828af19ef34c486c013b03739bf3c2439070925fd3ab932908d34efb60b537093764dc4e5084b210fc8511
SSDEEP 196608:VIpNcvoTQj9fZwQRCgjmpXHIEGn7jdfPjRMsqeXL2yrjAnDkyP:ypnkw8ERIEgfPjSDNWCkyP
TLSH
T121B633086BEA15F7F5F6453D8D52C82AE372BEA21F64C2DF026502781E17AD1497F322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-20_43b4e9e41a871378960fb8f678258d15_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 10.1MB
- SHA256 6723578fe50e2cef1e08fe5c620d9d6ce64960c0a3aeaffdf60c2ceb7decf458
- MD5 43b4e9e41a871378960fb8f678258d15
- SHA1 0d32bc0df0854bceeaa28c55bd466a121f236934
- SHA512 e7ac2603677206168581a5ecfb99a4b63efd3edc9c828af19ef34c486c013b03739bf3c2439070925fd3ab932908d34efb60b537093764dc4e5084b210fc8511
- SSDEEP 196608:VIpNcvoTQj9fZwQRCgjmpXHIEGn7jdfPjRMsqeXL2yrjAnDkyP:ypnkw8ERIEgfPjSDNWCkyP
- TLSH
  T121B633086BEA15F7F5F6453D8D52C82AE372BEA21F64C2DF026502781E17AD1497F322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2