General
- Target 2026-05-06_1333dbdf759839d8f0253f8080e276b7_amadey_blankgrabber_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc
- Size 8.3MB
- Sample260506-3qs2jsf15r
- SHA256 298fc3bf4313ad2cc4c9a58ba8d042da4818be09b86629804fac94fe784f7012
- MD5 1333dbdf759839d8f0253f8080e276b7
- SHA1 63d1cab555c581716cbf93dc657920cadcc60b8e
- SHA512 afd76af8105ee7ae1e0ffac0ef49ac5b6be5c7e539bb903b094730f55a2b7b0c0a6d358b5b65cc4c27cbc1182c0ec64579c9f609f7f018398290d243610a1f0b
- SSDEEP 98304:AkmDrLgXT0FLUUxlyletTotlJwDOU/jIEeQfoR/IuOFVjUu5o:AXLW+Lxy+TotlJwDFIF0wuy
- TLSH T1A596D113B6E540B4D0B3C27589768A13E671785543328AEF77DC965E1F32AE08F3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-06_1333dbdf759839d8f0253f8080e276b7_amadey_blankgrabber_cobalt-strike_glassworm_hijackloader.exe
Resource
win10v2004-20260130-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-06_1333dbdf759839d8f0253f8080e276b7_amadey_blankgrabber_cobalt-strike_glassworm_hijackloader.exe
Resource
win11-20260130-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-06_1333dbdf759839d8f0253f8080e276b7_amadey_blankgrabber_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc
- Size 8.3MB
- SHA256 298fc3bf4313ad2cc4c9a58ba8d042da4818be09b86629804fac94fe784f7012
- MD5 1333dbdf759839d8f0253f8080e276b7
- SHA1 63d1cab555c581716cbf93dc657920cadcc60b8e
- SHA512 afd76af8105ee7ae1e0ffac0ef49ac5b6be5c7e539bb903b094730f55a2b7b0c0a6d358b5b65cc4c27cbc1182c0ec64579c9f609f7f018398290d243610a1f0b
- SSDEEP 98304:AkmDrLgXT0FLUUxlyletTotlJwDOU/jIEeQfoR/IuOFVjUu5o:AXLW+Lxy+TotlJwDFIF0wuy
- TLSH T1A596D113B6E540B4D0B3C27589768A13E671785543328AEF77DC965E1F32AE08F3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE