General
- Target 2026-09-21_74774dba0475a1212ed3fd0258614a8c_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat
- Size 73.0MB
- Sample260922-pka2wsvgpc
- SHA256 d1d3e69d174a292902194453cfd111f52bcc01230d95c42c62d64f68c8ae2343
- MD5 74774dba0475a1212ed3fd0258614a8c
- SHA1 085544562a80af602f0aef6a76e5a699f17157a5
- SHA512 e086dd6bc4609554d4ada98da3aa8d0d9f28305d9a21981e5a9988d23211f121bb1e232921113e745f626f2a3cc4a112e5b9d773a9dda505ff59a3046b35c24c
- SSDEEP 1572864:vfjqEB0CBvgngQx8QcO7Ri3Y7gGYBPl19Gf21HbwIFiEBIE/:Tj0KvgMP38edGfWwCNj
- TLSH T1EAF7332584410A7FD8B28232B9A1D101CD11FC251779DAB69FCD874DFD7BBE89832E89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Behavioral task
behavioral1
Sample
2026-09-21_74774dba0475a1212ed3fd0258614a8c_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-21_74774dba0475a1212ed3fd0258614a8c_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260911-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-21_74774dba0475a1212ed3fd0258614a8c_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat
- Size 73.0MB
- SHA256 d1d3e69d174a292902194453cfd111f52bcc01230d95c42c62d64f68c8ae2343
- MD5 74774dba0475a1212ed3fd0258614a8c
- SHA1 085544562a80af602f0aef6a76e5a699f17157a5
- SHA512 e086dd6bc4609554d4ada98da3aa8d0d9f28305d9a21981e5a9988d23211f121bb1e232921113e745f626f2a3cc4a112e5b9d773a9dda505ff59a3046b35c24c
- SSDEEP 1572864:vfjqEB0CBvgngQx8QcO7Ri3Y7gGYBPl19Gf21HbwIFiEBIE/:Tj0KvgMP38edGfWwCNj
- TLSH T1EAF7332584410A7FD8B28232B9A1D101CD11FC251779DAB69FCD874DFD7BBE89832E89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Loads dropped DLL