c1e1b91ff302256d128a7a15478419b2b522da3d3dacd67ecdfcafc11641b89b

General

Target
2026-06-26_b421facfdae4579bd097c0c069500366_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 13.7MB
Sample260629-p9f97sd12y
SHA256 c1e1b91ff302256d128a7a15478419b2b522da3d3dacd67ecdfcafc11641b89b
MD5 b421facfdae4579bd097c0c069500366
SHA1 f61d747115e38979758a3aca7b6acebff3570260
SHA512 d911f921f29574c2c774dd2e58ee70b9242ee5cc47abb070d337ae3dd5a3993210746574d601b8ce72bfccef96af963d65efc1cddaf63a48521fa5ce3053d344
SSDEEP 393216:N85vzvVGTZHRok3meBcGfdHYMX5MlBK3w9D:K5vzkTZHRoaT5FHYqel3F
TLSH
T10CE6332A926D04E6CDE35139C292C564EB617CA78711D2CF07F09D9B3E5B6C8683EE70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-06-26_b421facfdae4579bd097c0c069500366_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 13.7MB
- SHA256 c1e1b91ff302256d128a7a15478419b2b522da3d3dacd67ecdfcafc11641b89b
- MD5 b421facfdae4579bd097c0c069500366
- SHA1 f61d747115e38979758a3aca7b6acebff3570260
- SHA512 d911f921f29574c2c774dd2e58ee70b9242ee5cc47abb070d337ae3dd5a3993210746574d601b8ce72bfccef96af963d65efc1cddaf63a48521fa5ce3053d344
- SSDEEP 393216:N85vzvVGTZHRok3meBcGfdHYMX5MlBK3w9D:K5vzkTZHRoaT5FHYqel3F
- TLSH
  T10CE6332A926D04E6CDE35139C292C564EB617CA78711D2CF07F09D9B3E5B6C8683EE70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access spyware stealer adware persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2