General
- Target 2026-05-22_159e2a6a43ccb4161992731bc3b474f5_amadey_blankgrabber_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc
- Size 8.1MB
- Sample260522-24kfwsav4y
- SHA256 4dea71ddd1e23108de796972cc9009a570d838e134ba8c4fa187cbdf4615bc3b
- MD5 159e2a6a43ccb4161992731bc3b474f5
- SHA1 e3e253ea0cb684dbce101cb576237dc73f7c1d9e
- SHA512 e58e94d31891582185418b82328282bc7a4f1429b1921b13db8f37a5f346640c2e5b09a4c0303c6555cf85e93c609d440b40c83d371f18bbd3a933a4d8a62754
- SSDEEP 98304:dQrxiMaB/GKBT1DMzZnlJPiIhxeoX2MgUrkOU/jIEeQfoR/IuOFVjUu5o:mpacaRDMzJ3JT0MRrkFIF0wuy
- TLSH T1D086D016B7E540B4D1F3C67589668A17EA717855033286EF33DC961E1F32AE08F3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-22_159e2a6a43ccb4161992731bc3b474f5_amadey_blankgrabber_cobalt-strike_glassworm_hijackloader.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_159e2a6a43ccb4161992731bc3b474f5_amadey_blankgrabber_cobalt-strike_glassworm_hijackloader.exe
Resource
win11-20260513-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-22_159e2a6a43ccb4161992731bc3b474f5_amadey_blankgrabber_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stealc
- Size 8.1MB
- SHA256 4dea71ddd1e23108de796972cc9009a570d838e134ba8c4fa187cbdf4615bc3b
- MD5 159e2a6a43ccb4161992731bc3b474f5
- SHA1 e3e253ea0cb684dbce101cb576237dc73f7c1d9e
- SHA512 e58e94d31891582185418b82328282bc7a4f1429b1921b13db8f37a5f346640c2e5b09a4c0303c6555cf85e93c609d440b40c83d371f18bbd3a933a4d8a62754
- SSDEEP 98304:dQrxiMaB/GKBT1DMzZnlJPiIhxeoX2MgUrkOU/jIEeQfoR/IuOFVjUu5o:mpacaRDMzJ3JT0MRrkFIF0wuy
- TLSH T1D086D016B7E540B4D1F3C67589668A17EA717855033286EF33DC961E1F32AE08F3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE