2026-05-28_9f55b977e0d24554fec09e52c0d3457f_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_9f55b977e0d24554fec09e52c0d3457f_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom
Size 1.6MB
Sample260528-wsh6ssh19y
SHA256 c82a875a0ee65d52f62cf3d5f7c7aee739d5b94e4053beb896e8796a03830674
MD5 9f55b977e0d24554fec09e52c0d3457f
SHA1 1ffe8b734bcf9fc7c1cdac01b8e8ef69bc15dd48
SHA512 7e2f4ec7bbb91b837763556514c30ee1353c250b1ea691fcf42c4fabaa72d50729bff4aa6b792e063fdb82c740ab86b1026751c9167b89cd8ed04f9c338d4184
SSDEEP 24576:wxLZKAyt5tmx1Y51t05ZtP7gQA+YXIySn46BKuK5XaMsG0TM2jlX6cL:UByHh51t0jaBm4MKuK5Xaksjl
TLSH
T1D675024AA3A451FCE1BBC178C992450ADB71FC250B70AADF17945AA71F23BE05E3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_9f55b977e0d24554fec09e52c0d3457f_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom

File Explorer

2026-05-28_9f55b977e0d24554fec09e52c0d3457f_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom

.exe 1.6MB

2026-05-28_9f55b977e0d24554fec09e52c0d3457f_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom

IMPHASH 2f2e89dfe589208550c326494e73d786
SHA256 c82a875a0ee65d52f62cf3d5f7c7aee739d5b94e4053beb896e8796a03830674
MD5 9f55b977e0d24554fec09e52c0d3457f
SHA1 1ffe8b734bcf9fc7c1cdac01b8e8ef69bc15dd48
SHA512 7e2f4ec7bbb91b837763556514c30ee1353c250b1ea691fcf42c4fabaa72d50729bff4aa6b792e063fdb82c740ab86b1026751c9167b89cd8ed04f9c338d4184
SSDEEP 24576:wxLZKAyt5tmx1Y51t05ZtP7gQA+YXIySn46BKuK5XaMsG0TM2jlX6cL:UByHh51t0jaBm4MKuK5Xaksjl
TLSH
T1D675024AA3A451FCE1BBC178C992450ADB71FC250B70AADF17945AA71F23BE05E3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1420688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

InternetOpenW InternetOpenUrlW HttpOpenRequestW HttpSendRequestW InternetReadFile InternetConnectW InternetCloseHandle

kernel32

GetOEMCP GetACP IsValidCodePage GetEnvironmentStringsW GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleOutputCP FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize HeapReAlloc WriteConsoleW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle WaitForSingleObject SetFileAttributesW MultiByteToWideChar Sleep CloseHandle CreateProcessW WideCharToMultiByte SetConsoleOutputCP ExpandEnvironmentStringsW ReadFile SetFilePointer CreateFileW GetLastError WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId GetCurrentProcessId GetTickCount ConnectNamedPipe SetEndOfFile DeleteFileW FindFirstFileW GetFileAttributesW GetFileAttributesExW MoveFileExW GetFileType LocalFree GetFileSizeEx GetFileTime SetFilePointerEx CreateDirectoryW FindClose FindFirstFileExW FindNextFileW GetFinalPathNameByHandleW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetProcAddress GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection RtlUnwind DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead FlushFileBuffers GetModuleHandleW InitializeCriticalSectionEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent ExitProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW GetCommandLineA GetCommandLineW

advapi32

GetSecurityInfo

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptEncrypt BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptDeriveKeyPBKDF2

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_9f55b977e0d24554fec09e52c0d3457f_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom

version

wininet

kernel32

advapi32

bcrypt

generic