General
- Target 2026-08-23_a77b0a3196c4f17c0e2661c13b36e4c3_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 25.6MB
- Sample260825-2rxwfsfj6w
- SHA256 a53fbaed48524fded0879ea28925f190c4d8b3ecb19748574b6eaf6b0fe85e6e
Score
10/10
Malware Config
Targets
-
- Target 2026-08-23_a77b0a3196c4f17c0e2661c13b36e4c3_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 25.6MB
- SHA256 a53fbaed48524fded0879ea28925f190c4d8b3ecb19748574b6eaf6b0fe85e6e
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Downloads MZ/PE file
-
Possible privilege escalation attempt
-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Drops file in System32 directory