Extracted

• • Target
    2026-09-11_da49cfcbd01d18161a4dec374eb7477e_blankgrabber_glassworm_icedid_luca-stealer_njrat
  • Size 50.5MB
  • SHA256 6a1ddac37df2cab41171782195a3edba70da577de4312ae815448093638c1ebc
  • MD5 da49cfcbd01d18161a4dec374eb7477e
  • SHA1 21b9c7e8d7209b01e752b56604d8b44e337ed179
  • SHA512 3ef7158478b431bf94cd5b3ea7248023c0a79d0dcc94510562f0b94acd4739cdde0be85166257596ba7f2f1f947516c703ded4ef65475f726e5414f1535e51ab
  • SSDEEP 786432:eaELLOVguqnQj8P6C9Eyy9XA8d2ZXTwNlpnyIqfJcshCnNDVMyMidQegd5UYTImf:eaULOVgsc69y6OZDYnk3S4WC59Um7r
  • TLSH
    T170C733F2FBB118DFC5460476C5D78522A79239EA67BC17D31B809199493B2B03B3CE26
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionphemedronepersistenceprivilege_escalationpyinstallerspywarestealer

  • Family: Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Stops running service(s)

    defense_evasionexecution

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2