General
- Target 2026-11-07_b9a744317e90e53bb347973e5836ca2f_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 67.6MB
- Sample261107-mqvmdacv2p
- SHA256 13b46e98e75f901286fa9d5b58928a4e77af5adb180f0a2f5110c7b4c5c70de1
Score
10/10
Malware Config
Targets
-
- Target 2026-11-07_b9a744317e90e53bb347973e5836ca2f_blankgrabber_glassworm_icedid_luca-stealer_njrat
- Size 67.6MB
- SHA256 13b46e98e75f901286fa9d5b58928a4e77af5adb180f0a2f5110c7b4c5c70de1
Score9/10- Custom signature
Detects executables packed with Themida
- Custom signature
Detects executables referencing many IR and analysis tools
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Modifies boot configuration data using bcdedit
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Loads dropped DLL
Themida packer
Detects Themida, an advanced Windows software protection system.
Checks whether UAC is enabled
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
Debugger Evasion
1Impair Defenses
1Disable or Modify Tools
1Virtualization/Sandbox Evasion
1