General
- Target 2026-09-06_9255fa27c4eabd81e833b06b9016e9f0_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc
- Size 9.4MB
- Sample260906-2fdnfa1ygv
- SHA256 93cda0acc43f8904f9b1a818c71533a2c07a67780a944cdfc48ebd4f114aa1b7
- MD5 9255fa27c4eabd81e833b06b9016e9f0
- SHA1 8ea18b396a79e01fd08a55d463998df6aa6d6695
- SHA512 f4a788f917cad35c45c2b6a052acf30c26bd776e8e59ca3e384506283697d0cbb9b13abee308c91586edef60fafd21a7396b78a32ffbfa5c3a8a47220a01471b
- SSDEEP 98304:sPEGLhndf0Dw08vsFcUDpAOOo/SNhzoVF0tYse+N:srJdf0Dw08vsFcUSOv/SNhzoVuOjI
- TLSH T19CA68C15E37800E8D4ABC2B8C7465257D771744A03B0ABDF1B90AEA52F37AE51E7B702
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-06_9255fa27c4eabd81e833b06b9016e9f0_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-06_9255fa27c4eabd81e833b06b9016e9f0_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc
- Size 9.4MB
- SHA256 93cda0acc43f8904f9b1a818c71533a2c07a67780a944cdfc48ebd4f114aa1b7
- MD5 9255fa27c4eabd81e833b06b9016e9f0
- SHA1 8ea18b396a79e01fd08a55d463998df6aa6d6695
- SHA512 f4a788f917cad35c45c2b6a052acf30c26bd776e8e59ca3e384506283697d0cbb9b13abee308c91586edef60fafd21a7396b78a32ffbfa5c3a8a47220a01471b
- SSDEEP 98304:sPEGLhndf0Dw08vsFcUDpAOOo/SNhzoVF0tYse+N:srJdf0Dw08vsFcUSOv/SNhzoVuOjI
- TLSH T19CA68C15E37800E8D4ABC2B8C7465257D771744A03B0ABDF1B90AEA52F37AE51E7B702
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks for any installed AV software in registry
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1