Extracted

Extracted

Extracted

Extracted

• • Target
    2026-05-31_d3d03e9f81416cc0c89e519f6747cbf3_blankgrabber_glassworm_icedid_luca-stealer_njrat
  • Size 11.8MB
  • SHA256 e95f39cae2c98b46f5f4d5e6587047273610ebde44755eae78d3f416200f8d72
  • MD5 d3d03e9f81416cc0c89e519f6747cbf3
  • SHA1 61848b1ed43f38d939c66ef17ad9fdd8044940d3
  • SHA512 3d27d23b8ef9366b6033e1638c1bb3b5b7dddd237b477275af4b0470464594108d344ed71da751df77cffd3279527c68e1f3b47279465fbd1fca61119d8a1c71
  • SSDEEP 196608:khsqlGN6mccrtbW897GDr/x7eovq5XMP6PzFcXLz+HskAS2r4ZRjMFZAnib:nq2r1yNdq1B7cn+HsnS2cZpi/
  • TLSH
    T167C6335943F30462ECD2D23A5AA285A6D2B27F511F22D79F0B64435A3E2B2F34D37790
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryevasionexecutionexploitpersistenceprivilege_escalationransomwaretrojan

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Blocks application from running via registry modification

    Adds application to list of disallowed applications.

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables service(s)

    defense_evasionexecution

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Stops running service(s)

    defense_evasionexecution

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2