General
- Target 2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc
- Size 9.4MB
- Sample260901-2mcdysck4v
- SHA256 939f688c233f5779bb737a5a573885436d5b4dd1a18ef57cc1e8aaef416764e0
- MD5 fe430427335a4a2c1d4ef63a3af0b218
- SHA1 049423b1ca8c829f4b37c952fc357d90237e58c4
- SHA512 85125a86978b21a28dc61c5225c79b112a455be77be8a57c521140805513a5089a1b8875e43731d4574163f43cdb803f5fce8cfd881ad8cf5681345cf683fdcc
- SSDEEP 196608:e83DGUbeWpQj3emtIpt+h+UOjtP+cR5X:RzPbeWpQj3emtIpt+h+UOZP+O
- TLSH T1D6A68C55E37800D8D4ABC2B8C7465253D771744A03B0ABDF1B90AEA62F33AE51E7B712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc
- Size 9.4MB
- SHA256 939f688c233f5779bb737a5a573885436d5b4dd1a18ef57cc1e8aaef416764e0
- MD5 fe430427335a4a2c1d4ef63a3af0b218
- SHA1 049423b1ca8c829f4b37c952fc357d90237e58c4
- SHA512 85125a86978b21a28dc61c5225c79b112a455be77be8a57c521140805513a5089a1b8875e43731d4574163f43cdb803f5fce8cfd881ad8cf5681345cf683fdcc
- SSDEEP 196608:e83DGUbeWpQj3emtIpt+h+UOjtP+cR5X:RzPbeWpQj3emtIpt+h+UOZP+O
- TLSH T1D6A68C55E37800D8D4ABC2B8C7465253D771744A03B0ABDF1B90AEA62F33AE51E7B712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Checks for any installed AV software in registry
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.