blankgrabber | 03c1ec8bc469eb4b5cd4606ad570f3e0daddb204b3b5618717f713fa2de527a4

General

Target
2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat
Size 11.0MB
Sample260926-2skyaagh95
SHA256 03c1ec8bc469eb4b5cd4606ad570f3e0daddb204b3b5618717f713fa2de527a4
MD5 52825ee7bfa74f6b90d0a37813cfb130
SHA1 7a9199fa3d8028eb5c2db1a581ed9de981ec9f17
SHA512 9ca58362a9291f288ff1a3bae9708d5dcdddb5cfeffac67d200e341755df5fdbe27fd46205b1d22c1fc22d6f1678ad01da6b3753f4970860b1f9eee0e0a88cd3
SSDEEP 196608:ASL5tIOJwVqiqpCJkO87wygVwQUO6vlTmHAGh64HsF5PPNaSRrdZRgF0xnE8Dzn9:ddasTf5QvShmHvxHsF5laSRZZY6Hn46
TLSH
T198C633A46FC104A6E9AA503EA967C50BF3B178616B92D7DF077857112E2B0D24F3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-26_52825ee7bfa74f6b90d0a37813cfb130_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 11.0MB
- SHA256 03c1ec8bc469eb4b5cd4606ad570f3e0daddb204b3b5618717f713fa2de527a4
- MD5 52825ee7bfa74f6b90d0a37813cfb130
- SHA1 7a9199fa3d8028eb5c2db1a581ed9de981ec9f17
- SHA512 9ca58362a9291f288ff1a3bae9708d5dcdddb5cfeffac67d200e341755df5fdbe27fd46205b1d22c1fc22d6f1678ad01da6b3753f4970860b1f9eee0e0a88cd3
- SSDEEP 196608:ASL5tIOJwVqiqpCJkO87wygVwQUO6vlTmHAGh64HsF5PPNaSRrdZRgF0xnE8Dzn9:ddasTf5QvShmHvxHsF5laSRZZY6Hn46
- TLSH
  T198C633A46FC104A6E9AA503EA967C50BF3B178616B92D7DF077857112E2B0D24F3F321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2