88a32a02a5fd8db6fc58c8549944f8cb9e04d02b936057dac958263e5cfdde71

General

Target
2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz
Size 53.4MB
Sample260824-3khnmazzdv
SHA256 88a32a02a5fd8db6fc58c8549944f8cb9e04d02b936057dac958263e5cfdde71
MD5 d72cac618cdc5222f55e5f6515340dd9
SHA1 bb695fe37a41920f55c4a7583fe80dde656f9e82
SHA512 c784b7cba384ed73ff2a8a818205d2bbc60d1b09dd62b55dcab5fb157df76e7d97dfab343a1db388fe75f92dfcfae5b48142c36bf40db3591f3e1df167fab6fe
SSDEEP 393216:KSuLbP8kNEzixq3QthJXs6XC/sPM9dweq8EZzlxl27EnmvgTfIj9JS3sgmrYN9+c:KiAukA8zrI8rfKKSdGV89eJ
TLSH
T100C78C0273E501A6E177D1398A9B4103EB72B4171B30DBDB369C43642F67BE49EBAB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-24_d72cac618cdc5222f55e5f6515340dd9_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz
- Size 53.4MB
- SHA256 88a32a02a5fd8db6fc58c8549944f8cb9e04d02b936057dac958263e5cfdde71
- MD5 d72cac618cdc5222f55e5f6515340dd9
- SHA1 bb695fe37a41920f55c4a7583fe80dde656f9e82
- SHA512 c784b7cba384ed73ff2a8a818205d2bbc60d1b09dd62b55dcab5fb157df76e7d97dfab343a1db388fe75f92dfcfae5b48142c36bf40db3591f3e1df167fab6fe
- SSDEEP 393216:KSuLbP8kNEzixq3QthJXs6XC/sPM9dweq8EZzlxl27EnmvgTfIj9JS3sgmrYN9+c:KiAukA8zrI8rfKKSdGV89eJ
- TLSH
  T100C78C0273E501A6E177D1398A9B4103EB72B4171B30DBDB369C43642F67BE49EBAB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution persistence spyware stealer trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
  defense_evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Hide Artifacts: Hidden Window
  Windows that would typically be displayed when an application carries out an operation can be hidden.
  defense_evasion
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2