bbccb6622d08e596f70d2289fc58daaf8061c3ac9afc6db97b91319a4fd018aa

General

Target
2026-05-22_19ef82ba64b5e857c7b0d653459991e9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 21.5MB
Sample260522-jmc2daaw2w
SHA256 bbccb6622d08e596f70d2289fc58daaf8061c3ac9afc6db97b91319a4fd018aa
MD5 19ef82ba64b5e857c7b0d653459991e9
SHA1 c0699a47d66c5fbfd1d63f905fa5e3cffa8ffa50
SHA512 a0f746a7d00b98b0e8f2465fb50b3739320838f714cc412d16136124521db1345a944cdd40d6548bfc6030351d06d9b5d98a6ad82e81257873f588e43186341a
SSDEEP 393216:rKDIybkCrLHF7ge1A3sB1DnpDSeXoGFIvHtyvDBzncIBO2BIy56CpI:Irzx1tB1tDSaj6VaFzncIBO2Bst
TLSH
T1153733157B2204D8F99FB63A68E0425393E1B17127708FCF0FE408E92A5B4E4EE75B95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-05-22_19ef82ba64b5e857c7b0d653459991e9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 21.5MB
- SHA256 bbccb6622d08e596f70d2289fc58daaf8061c3ac9afc6db97b91319a4fd018aa
- MD5 19ef82ba64b5e857c7b0d653459991e9
- SHA1 c0699a47d66c5fbfd1d63f905fa5e3cffa8ffa50
- SHA512 a0f746a7d00b98b0e8f2465fb50b3739320838f714cc412d16136124521db1345a944cdd40d6548bfc6030351d06d9b5d98a6ad82e81257873f588e43186341a
- SSDEEP 393216:rKDIybkCrLHF7ge1A3sB1DnpDSeXoGFIvHtyvDBzncIBO2BIy56CpI:Irzx1tB1tDSaj6VaFzncIBO2Bst
- TLSH
  T1153733157B2204D8F99FB63A68E0425393E1B17127708FCF0FE408E92A5B4E4EE75B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery persistence spyware stealer
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2