General
- Target 2026-06-29_da3812e5aea161fba608fbda770bf7c8_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 10.7MB
- Sample260630-c8yrmsc12w
- SHA256 d2606954a715850858e894f53ce8088b0d60e969b156862187d783828ddd9e9e
- MD5 da3812e5aea161fba608fbda770bf7c8
- SHA1 98c46d95cb6512f4acbca8a417ec791d1e2d5d0e
- SHA512 adc13c5efe79170fed43585339027dc6e7cebfff07365c4635ced386300c6f5f4658113718293df8e6147caa2092a8aa2749ae786e9865ab1173efeebabed943
- SSDEEP 196608:mmFTNTwhLQHLEnHAdPtbMhAKjQoDKGpA/ShODWN4FMIZETxjPePdrQJck0ax8NBB:VaLQHLEngzbMhAKlA6hOKNQETxvJcax+
- TLSH T1A2B63345A3A104E8EAA7C17CC566D87AEA763C361724D2C703F6999B3E134A07C7DF48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Behavioral task
behavioral1
Sample
2026-06-29_da3812e5aea161fba608fbda770bf7c8_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-29_da3812e5aea161fba608fbda770bf7c8_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260629-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-29_da3812e5aea161fba608fbda770bf7c8_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 10.7MB
- SHA256 d2606954a715850858e894f53ce8088b0d60e969b156862187d783828ddd9e9e
- MD5 da3812e5aea161fba608fbda770bf7c8
- SHA1 98c46d95cb6512f4acbca8a417ec791d1e2d5d0e
- SHA512 adc13c5efe79170fed43585339027dc6e7cebfff07365c4635ced386300c6f5f4658113718293df8e6147caa2092a8aa2749ae786e9865ab1173efeebabed943
- SSDEEP 196608:mmFTNTwhLQHLEnHAdPtbMhAKjQoDKGpA/ShODWN4FMIZETxjPePdrQJck0ax8NBB:VaLQHLEngzbMhAKlA6hOKNQETxvJcax+
- TLSH T1A2B63345A3A104E8EAA7C17CC566D87AEA763C361724D2C703F6999B3E134A07C7DF48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Renames multiple (6772) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Loads dropped DLL
-
Drops file in System32 directory