2026-06-30_b8ce3258d841e0643022ff72950d2343_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

General

Target
2026-06-30_b8ce3258d841e0643022ff72950d2343_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom
Size 32.7MB
Sample260701-dn241ae16z
SHA256 761527051adebc7010d9495edc08678df3918ba23a53b0b08f89e9243135462d
MD5 b8ce3258d841e0643022ff72950d2343
SHA1 aeae240e9adab7eb1bde8d41de388f88f9c5be37
SHA512 99d1568159262b76fa227c28718dd7cf0c3f4af668e8de239f9e953fb32d7740e6c43b08b5216c66bda926fbfe526b2a6f80feea4acfe523cd05868e5a428d0a
SSDEEP 786432:Wq82G4TLcNOCzrsRphVUC+nT5T5IBo+vAX5PHpvl7fwe:WqrTIAyIPhVOThcQxffwe
TLSH
T153773392778122EAE4F60036E871CA71A373B6A63F70E5BF1BA507551C7B6C00DB8761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_b8ce3258d841e0643022ff72950d2343_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

File Explorer

2026-06-30_b8ce3258d841e0643022ff72950d2343_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

.exe 32.7MB
verusity.pyc

93KB

2026-06-30_b8ce3258d841e0643022ff72950d2343_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

IMPHASH 8d40fbc4e133fbac6b61c5f00b79afa3
SHA256 761527051adebc7010d9495edc08678df3918ba23a53b0b08f89e9243135462d
MD5 b8ce3258d841e0643022ff72950d2343
SHA1 aeae240e9adab7eb1bde8d41de388f88f9c5be37
SHA512 99d1568159262b76fa227c28718dd7cf0c3f4af668e8de239f9e953fb32d7740e6c43b08b5216c66bda926fbfe526b2a6f80feea4acfe523cd05868e5a428d0a
SSDEEP 786432:Wq82G4TLcNOCzrsRphVUC+nT5T5IBo+vAX5PHpvl7fwe:WqrTIAyIPhVOThcQxffwe
TLSH
T153773392778122EAE4F60036E871CA71A373B6A63F70E5BF1BA507551C7B6C00DB8761
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcess TerminateProcess ResumeThread CreateProcessA GetThreadContext SetThreadContext GlobalMemoryStatusEx GetSystemInfo GetTickCount VirtualProtect VirtualAllocEx ReadProcessMemory WriteProcessMemory Sleep GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource LoadLibraryA FindResourceA CreateToolhelp32Snapshot Process32First Process32Next WriteConsoleW CreateFileW WaitForSingleObject CloseHandle CheckRemoteDebuggerPresent DebugBreak IsDebuggerPresent GetTempPathA WriteFile GetFileSizeEx GetDiskFreeSpaceExA FlushFileBuffers FindNextFileA FindFirstFileA FindClose DeleteFileA GetModuleFileNameA CreateFileA SetFilePointerEx GetConsoleMode GetConsoleOutputCP HeapReAlloc HeapSize GetProcessHeap QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree HeapAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx CompareStringW LCMapStringW

user32

GetCursorPos wsprintfA

advapi32

CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegDeleteTreeA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegDeleteKeyA RegCreateKeyExA RegCloseKey GetTokenInformation OpenProcessToken

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptSetProperty

Name

.text

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32.6MB

Virtual Size

32.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_b8ce3258d841e0643022ff72950d2343_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom

kernel32

user32

advapi32

bcrypt

generic

verusity.pyc