2026-06-30_9b8540241338f3877baee47d85819d90_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_9b8540241338f3877baee47d85819d90_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar
Size 11.8MB
Sample260701-d7bfdsfv8y
SHA256 272253cdbe7a9fa70cf9e4d12ab4674bba0f543320ca115cdcdd34659fd1e869
MD5 9b8540241338f3877baee47d85819d90
SHA1 84803fba7b08b9250988c9fb9bc2acb5276c2032
SHA512 8f8754f987b3f12b01cebf32eeb48c6b37e1a6af86d3640cfc5b94892f5613bc5d871838b2d39b2ba62a5f3e3af0a4b8d1d36abbadf953b87f6c063e88c37de6
SSDEEP 196608:IVCyt2u7udqeTtKGVvhWiD4wZ5TE+rN87cCGF0Bf9n1dEMPM:zBKo5AgZ5TEc0cZSf1j4
TLSH
T1BBC6120A7AAC00F4C1BEC138C957550AEA717CA507359AEB62E0BE592F37AF05E7D701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-06-30_9b8540241338f3877baee47d85819d90_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar

.exe 11.8MB

2026-06-30_9b8540241338f3877baee47d85819d90_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar

IMPHASH f543bcdaff77422fffb58992540d4c1e
SHA256 272253cdbe7a9fa70cf9e4d12ab4674bba0f543320ca115cdcdd34659fd1e869
MD5 9b8540241338f3877baee47d85819d90
SHA1 84803fba7b08b9250988c9fb9bc2acb5276c2032
SHA512 8f8754f987b3f12b01cebf32eeb48c6b37e1a6af86d3640cfc5b94892f5613bc5d871838b2d39b2ba62a5f3e3af0a4b8d1d36abbadf953b87f6c063e88c37de6
SSDEEP 196608:IVCyt2u7udqeTtKGVvhWiD4wZ5TE+rN87cCGF0Bf9n1dEMPM:zBKo5AgZ5TEc0cZSf1j4
TLSH
T1BBC6120A7AAC00F4C1BEC138C957550AEA717CA507359AEB62E0BE592F37AF05E7D701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

a2:6b:09:f8:bd:75:ba:0b:1f:60:0a:5b:01:52:8e:f1:5d:1d:42:d0:d5:9e:69:6a:c3:af:25:c9:e7:5b:88:97

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Chains

Jun 23, 2026

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Gen Digital Inc.,O=Gen Digital Inc.,ST=Arizona,C=US

Serial Number

40:1c:57:14:6d:ce:58:df:b9:22:21:87:8d:2a:a5:63

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 11, 2025 - Jun 10, 2028

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

298496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\SfxInstOne.pdb

dwmapi

DwmSetWindowAttribute

bcrypt

BCryptEncrypt BCryptGenerateSymmetricKey BCryptDeriveKey BCryptSecretAgreement BCryptExportKey BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptImportKeyPair BCryptSetProperty BCryptOpenAlgorithmProvider BCryptDestroySecret BCryptDestroyKey BCryptCloseAlgorithmProvider

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader NtDeleteKey NtQueryKey NtOpenKey NtSetInformationThread NtClose VerSetConditionMask RtlGetLastNtStatus RtlNtStatusToDosError RtlUnwind

kernel32

ExitThread InterlockedPushEntrySList GetStartupInfoW InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx SetThreadAffinityMask WriteConsoleW HeapQueryInformation GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle EnumSystemLocalesW IsValidLocale LCMapStringW FlsFree GetProcAddress GetModuleHandleW CloseHandle SetLastError GetLastError CreateFileW DeviceIoControl WideCharToMultiByte MultiByteToWideChar FindClose FindFirstFileW RemoveDirectoryW Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject SetFilePointerEx GetFileSizeEx UnmapViewOfFile ReadFile GetCurrentProcessId CreateFileMappingW MapViewOfFile OpenFileMappingW HeapAlloc GetProcessHeap GetSystemDirectoryW lstrcatW GetModuleHandleA LocalFree CreateProcessW CreateEventW ResumeThread GetExitCodeProcess GetCurrentThread GetCurrentProcess FindResourceW SizeofResource LockResource LoadResource GlobalAlloc GlobalLock GlobalFree GlobalUnlock SetEvent CreateThread TerminateThread GetLocaleInfoW GetModuleFileNameA GetModuleHandleExW FreeLibrary GetCurrentThreadId FormatMessageW HeapFree DebugBreak GetUserDefaultLangID LoadLibraryA IsProcessorFeaturePresent ProcessIdToSessionId OpenProcess GetCommandLineW GetFileTime GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemTimeAsFileTime FileTimeToSystemTime GetNativeSystemInfo GetPrivateProfileStringW InitializeCriticalSectionEx LCIDToLocaleName HeapSize GetUserDefaultLCID HeapReAlloc DecodePointer HeapDestroy WaitForMultipleObjects WriteFile ResetEvent CompareStringW GetOverlappedResult CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatus CancelIoEx GetTickCount64 VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive UnlockFile LockFileEx OutputDebugStringW FreeLibraryAndExitThread GetFileAttributesExW CompareFileTime LoadLibraryExW TerminateProcess VerifyVersionInfoW QueryUnbiasedInterruptTime GetTickCount SetThreadPriority InitializeCriticalSectionAndSpinCount RaiseException GetThreadTimes QueryThreadCycleTime UnlockFileEx LoadLibraryW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetProcessImageFileNameW GetProcessTimes GetPriorityClass K32GetProcessMemoryInfo FlushFileBuffers DeleteFileW GetFileInformationByHandle GetFullPathNameW OutputDebugStringA TlsAlloc TlsGetValue TlsSetValue GetModuleFileNameW CreateSemaphoreW LCMapStringEx GetSystemInfo GetVersionExW ExpandEnvironmentStringsW GetShortPathNameW GetFileAttributesW GetSystemWindowsDirectoryW GetProcessAffinityMask GetLongPathNameW VirtualProtect GlobalMemoryStatusEx GetEnvironmentVariableW GetExitCodeThread TlsFree SetFilePointer SetFileAttributesW GetFileSize SetEndOfFile MoveFileExW GetWindowsDirectoryW DuplicateHandle SetFileTime CreateDirectoryW GetCurrentDirectoryW FindFirstFileExW FindNextFileW QueryDosDeviceW GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetVersion FindResourceExW SetEnvironmentVariableW WriteProcessMemory CopyFileW SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW VirtualQuery FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SystemTimeToFileTime GetSystemTimes EncodePointer FlsSetValue FlsGetValue WakeConditionVariable CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetLocaleInfoEx TzSpecificLocalTimeToSystemTime GetStdHandle ExitProcess GetFileType IsDebuggerPresent ReleaseSemaphore FormatMessageA WakeAllConditionVariable SleepConditionVariableSRW AcquireSRWLockShared ReleaseSRWLockShared TryAcquireSRWLockExclusive GetStringTypeW InitOnceComplete InitOnceBeginInitialize WaitForSingleObjectEx AreFileApisANSI LoadLibraryExA ReadConsoleW GetConsoleOutputCP FlsAlloc GetConsoleMode

fltlib

FilterGetMessage FilterSendMessage FilterLoad FilterConnectCommunicationPort FilterReplyMessage

rpcrt4

RpcEpUnregister UuidFromStringW

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

515KB

Virtual Size

515KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

67KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=206, id=261, version=33138,

count=10, id=259, version=33138,

count=1, id=263, version=33138,

count=4, id=253, version=34321,

count=19, id=260, version=34321,

count=12, id=259, version=34321,

count=125, id=261, version=34321,

count=36, id=260, version=33138,

count=2, id=257, version=30795,

count=2, id=259, version=33520,

count=9, id=260, version=33520,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=10, id=260, version=32545,

count=13, productName=Unmarked objects (old),

count=4, id=261, version=32545,

count=21, id=257, version=33138,

count=587, id=1, productName=Unmarked objects,

count=309, id=265, version=34436,

count=1, id=256, version=34436,

count=1, id=255, version=34436,

count=2, id=151,

count=1, id=258, version=34436,