2026-05-28_c94ed89c66eb8cb91938d1e6003b84b3_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_c94ed89c66eb8cb91938d1e6003b84b3_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 10.1MB
Sample260528-lrvs4ady4y
SHA256 b4592ce1f9e15d3c52be8fe9d8215dbd73068d06ec1ac1601c1c324acb7a1913
MD5 c94ed89c66eb8cb91938d1e6003b84b3
SHA1 7d2511787797cd6de15add6579499ea742f51fc7
SHA512 3b2a7326e6db0be81f6d6a2ad1a9fd4ccd3c02e72df9f978754db743010852f88e85e839e374f0b7c2b8aaa9ee574021dc81ba9bc68dde70858135dcd34d1735
SSDEEP 196608:/zPBDxZK8/pU7VC5G/7/IU+/3wqyTRdHT:/1DxZKNVC5G/7/IU+/3wFN
TLSH
T1AEB6AECBF69145D9C079B03846975627FD7238150F38E1FF83C06A262B76BA85E7A306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_c94ed89c66eb8cb91938d1e6003b84b3_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-05-28_c94ed89c66eb8cb91938d1e6003b84b3_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 10.1MB

2026-05-28_c94ed89c66eb8cb91938d1e6003b84b3_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH caf14c818f24aea8f390e8e0943e4940
SHA256 b4592ce1f9e15d3c52be8fe9d8215dbd73068d06ec1ac1601c1c324acb7a1913
MD5 c94ed89c66eb8cb91938d1e6003b84b3
SHA1 7d2511787797cd6de15add6579499ea742f51fc7
SHA512 3b2a7326e6db0be81f6d6a2ad1a9fd4ccd3c02e72df9f978754db743010852f88e85e839e374f0b7c2b8aaa9ee574021dc81ba9bc68dde70858135dcd34d1735
SSDEEP 196608:/zPBDxZK8/pU7VC5G/7/IU+/3wqyTRdHT:/1DxZKNVC5G/7/IU+/3wFN
TLSH
T1AEB6AECBF69145D9C079B03846975627FD7238150F38E1FF83C06A262B76BA85E7A306
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6863696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Legacyoreo\loader\Rivals\Release\Loader.pdb

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RtlUnwind RtlCaptureContext VerSetConditionMask RtlVirtualUnwind

advapi32

CryptDestroyKey SystemFunction036 CryptEncrypt CryptImportKey RegOpenKeyExW RegEnumKeyExW RegCloseKey RegQueryValueExW RegSetValueExW RegDeleteTreeW RegCreateKeyW RegSetKeyValueW GetTokenInformation GetLengthSid GetUserNameA OpenProcessToken SetSecurityInfo RegCreateKeyExA InitializeAcl AddAccessAllowedAce IsValidSid RegDeleteKeyA CopySid ConvertSidToStringSidW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash

crypt32

CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateChainEngine CertOpenStore CertCreateCertificateChainEngine CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject

ws2_32

WSAWaitForMultipleEvents WSACloseEvent WSACreateEvent getsockopt WSAEnumNetworkEvents inet_pton freeaddrinfo getaddrinfo ntohl closesocket WSAGetLastError ntohs WSASetLastError WSAStartup WSAEventSelect WSAResetEvent send inet_ntop WSACleanup bind gethostname ioctlsocket sendto recvfrom listen htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect

httpapi

HttpCreateRequestQueue HttpReceiveHttpRequest HttpCreateServerSession HttpSetUrlGroupProperty HttpInitialize HttpSendHttpResponse HttpAddUrlToUrlGroup HttpCreateUrlGroup

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsQuery_A DnsFree

winhttp

WinHttpGetDefaultProxyConfiguration

user32

PeekMessageW GetSystemMetrics RegisterClassExW SetProcessDpiAwarenessContext DefWindowProcW DispatchMessageW CreateWindowExW DestroyWindow SetWindowRgn ShowWindow PostQuitMessage TranslateMessage ReleaseDC UpdateWindow GetDC UnregisterClassW SetWindowPos GetCursorPos GetWindowRect SetClipboardData OpenClipboard CloseClipboard EmptyClipboard MessageBoxA SetCursor SetCapture SetProcessDPIAware GetKeyState GetCapture ClientToScreen MonitorFromWindow ReleaseCapture SetCursorPos GetForegroundWindow GetMessageExtraInfo IsWindowUnicode GetClientRect GetKeyboardLayout TrackMouseEvent LoadCursorW ScreenToClient GetClipboardData

gdi32

CreateRoundRectRgn DeleteObject CreateRectRgn GetDeviceCaps

shell32

SHAddToRecentDocs SHGetFolderPathW ShellExecuteW SHGetFolderPathA ShellExecuteA

kernel32

LoadLibraryExW GetConsoleOutputCP ReadConsoleW GetConsoleMode SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetTimeFormatW IsProcessorFeaturePresent UnhandledExceptionFilter TerminateProcess CreateProcessW DuplicateHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation WaitForSingleObject GetExitCodeProcess FlsFree FlsSetValue FlsGetValue FlsAlloc CreatePipe SetStdHandle SetEndOfFile RaiseException OutputDebugStringW GetCPInfo GetStringTypeW LCMapStringEx EncodePointer TryAcquireSRWLockExclusive GetSystemTimePreciseAsFileTime GetLocaleInfoEx GetExitCodeThread GetFileInformationByHandleEx CopyFile2 AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFullPathNameW GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetCurrentDirectoryW FormatMessageA InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW GetDateFormatW FreeEnvironmentStringsW SetEnvironmentVariableW GetDriveTypeW CreateProcessA CreateMutexW GetProcAddress WriteFile ExitProcess GetThreadContext Process32FirstW IsDebuggerPresent GetSystemTimeAsFileTime CreateDirectoryA SetPriorityClass RemoveDirectoryA VirtualProtect GetModuleHandleA SetFileTime CreateFileA GetEnvironmentVariableA GetCurrentThread DeleteFileA GetModuleHandleW GetTickCount64 QueryPerformanceCounter CheckRemoteDebuggerPresent CopyFileA SetEnvironmentVariableA SetFilePointer GetFileSize QueryPerformanceFrequency GetCurrentProcessId ReadFile CreateToolhelp32Snapshot CloseHandle GetCurrentProcess GetTempPathA WriteConsoleW GetLastError GetModuleFileNameA DeleteFileW GetFileAttributesA GetLogicalDrives SetFileAttributesA GetDriveTypeA MultiByteToWideChar CreateFileW RemoveDirectoryW FlushFileBuffers CreateDirectoryW GetTempPathW DeviceIoControl GlobalUnlock GlobalLock WideCharToMultiByte GlobalAlloc GlobalFree FreeLibrary GetLocaleInfoA LoadLibraryA VirtualQuery UnmapViewOfFile GetModuleFileNameW HeapReAlloc GetSystemDirectoryW InitializeCriticalSectionEx AddDllDirectory SetDllDirectoryW MapViewOfFile AddVectoredExceptionHandler CreateThread Sleep DeleteCriticalSection CreateFileMappingW GetModuleHandleExA GetProcessHeap GetCurrentThreadId QueryFullProcessImageNameW HeapDestroy HeapAlloc DecodePointer SetDefaultDllDirectories HeapFree HeapSize LocalFree ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageW EnterCriticalSection LeaveCriticalSection LoadLibraryW SleepEx GetTickCount MoveFileExW WaitForSingleObjectEx GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx InitializeCriticalSection GetSystemInfo VirtualAlloc CreateFileMappingA Process32NextW

bcrypt

BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptSetProperty BCryptEncrypt BCryptGenRandom

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmIsCompositionEnabled DwmGetColorizationColor

winmm

PlaySoundW

imm32

ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

Name

.text

Size

6.8MB

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.9MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_c94ed89c66eb8cb91938d1e6003b84b3_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

d3d11

ntdll

advapi32

crypt32

ws2_32

httpapi

psapi

wintrust

dnsapi

winhttp

user32

gdi32

shell32

kernel32

bcrypt

dwmapi

winmm

imm32

d3dcompiler_47

shlwapi

userenv

generic