blankgrabber | 019e5515e907e42c0aa7a657ca02aa177b51e3b3dd135c5439485a23cfaed150

General

Target
2026-09-17_1dd1b7e9688aafd0240758b3383855be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 75.0MB
Sample260917-129sbsdb75
SHA256 019e5515e907e42c0aa7a657ca02aa177b51e3b3dd135c5439485a23cfaed150
MD5 1dd1b7e9688aafd0240758b3383855be
SHA1 ea9b143e4a17d956de266be1da10064c1ee9eea5
SHA512 e4f4d73700e81610e76d58750d29c4b589d0b94d4ead37cb877c0c9bcc0b53a02307b608ecd5ebc3f81b0e7571b4b9e3eb9f03ce65c0bd0cc7fe32dff58f75a8
SSDEEP 196608:GTYS6FOshoKMuIkhVastRL5Di3uz1D7c0v:WYSEOshouIkPftRL54aRZv
TLSH
T198083311F3A458EAF991963AC286C616DB33395123E0D58B079847B21F271AE4C3FF5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-17_1dd1b7e9688aafd0240758b3383855be_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 75.0MB
- SHA256 019e5515e907e42c0aa7a657ca02aa177b51e3b3dd135c5439485a23cfaed150
- MD5 1dd1b7e9688aafd0240758b3383855be
- SHA1 ea9b143e4a17d956de266be1da10064c1ee9eea5
- SHA512 e4f4d73700e81610e76d58750d29c4b589d0b94d4ead37cb877c0c9bcc0b53a02307b608ecd5ebc3f81b0e7571b4b9e3eb9f03ce65c0bd0cc7fe32dff58f75a8
- SSDEEP 196608:GTYS6FOshoKMuIkhVastRL5Di3uz1D7c0v:WYSEOshouIkPftRL54aRZv
- TLSH
  T198083311F3A458EAF991963AC286C616DB33395123E0D58B079847B21F271AE4C3FF5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2