2026-07-01_b6ac1e726ccd7e33f95467048cfe847c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_remcos_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-01_b6ac1e726ccd7e33f95467048cfe847c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_remcos_satacom_stealc
Size 6.7MB
Sample260701-jrdhpsht7m
SHA256 4b6370994e753adc757a33041d86505a164fd909b7a2b9773cd131a0372f7cad
MD5 b6ac1e726ccd7e33f95467048cfe847c
SHA1 76a811f135b7011770c4b3037dfc6124e19d2962
SHA512 ce26f87aabf8f51f8f2721c214febcdea18a8c3d0c457dffd3991be1eedce9bdda3fe1525f5a3e1664dd060080b9c8af06c7c58a844873d1c85f9c824ea11882
SSDEEP 49152:XiTVBx7hV3k1uy0IbrKYBlGXaCzX6wvwT9HOzGANZS1pEGFQYUvJBynPT8+HEeKk:eBoXEvbouzGANZS1pEGvplSFoz
TLSH
T18766BF4263AD01EAC167D138C6868717E7B27C5523309BEB67D04E662FA3AF05A7F350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-01_b6ac1e726ccd7e33f95467048cfe847c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_remcos_satacom_stealc

File Explorer

2026-07-01_b6ac1e726ccd7e33f95467048cfe847c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_remcos_satacom_stealc

.exe 6.7MB

2026-07-01_b6ac1e726ccd7e33f95467048cfe847c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_remcos_satacom_stealc

IMPHASH ccd521f7b066c68ef1a285b23392be79
SHA256 4b6370994e753adc757a33041d86505a164fd909b7a2b9773cd131a0372f7cad
MD5 b6ac1e726ccd7e33f95467048cfe847c
SHA1 76a811f135b7011770c4b3037dfc6124e19d2962
SHA512 ce26f87aabf8f51f8f2721c214febcdea18a8c3d0c457dffd3991be1eedce9bdda3fe1525f5a3e1664dd060080b9c8af06c7c58a844873d1c85f9c824ea11882
SSDEEP 49152:XiTVBx7hV3k1uy0IbrKYBlGXaCzX6wvwT9HOzGANZS1pEGFQYUvJBynPT8+HEeKk:eBoXEvbouzGANZS1pEGvplSFoz
TLSH
T18766BF4263AD01EAC167D138C6868717E7B27C5523309BEB67D04E662FA3AF05A7F350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ce:dc:15:37:3c:fa:91:cc:59:f1:bd:e7:1a:bf:f2:e9:e3:a3:78:dd:47:b3:9c:5c:ad:52:81:b6:56:f3:51:98

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=07604582000164,CN=Firecheats Ltda,OU=Software Publishing,O=Firecheats Ltda,L=Sao Paulo,ST=SP,C=BR,1.2.840.113549.1.9.1=#0c19636f6e7461746f40666972656368656174732e636f6d2e6272

Chains

Jun 30, 2026

SERIALNUMBER=07604582000164,CN=Firecheats Ltda,OU=Software Publishing,O=Firecheats Ltda,L=Sao Paulo,ST=SP,C=BR,1.2.840.113549.1.9.1=#0c19636f6e7461746f40666972656368656174732e636f6d2e6272

Minor OS version

Major OS version

Entry point

2286800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

iphlpapi

if_nametoindex GetAdaptersInfo

d3dx9_43

D3DXVec3Normalize D3DXVec3Transform D3DXMatrixTranspose

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GlobalUnlock GetLocaleInfoA VerSetConditionMask GlobalLock GlobalFree HeapSize WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetTimeZoneInformation GetOEMCP GetACP IsValidCodePage SetEndOfFile DeleteFileW SetStdHandle FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetModuleFileNameW IsProcessorFeaturePresent SetFilePointerEx GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread ExitThread RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW GetCPInfo CompareStringEx GlobalAlloc GetStartupInfoA GetLastError GetCommandLineA GetProcessTimes WideCharToMultiByte GlobalMemoryStatusEx K32GetProcessMemoryInfo Sleep WaitForSingleObject VirtualProtectEx Process32Next MultiByteToWideChar Module32First Module32Next Process32First VirtualFreeEx SetUnhandledExceptionFilter CheckRemoteDebuggerPresent IsDebuggerPresent QueryPerformanceCounter CreateRemoteThread ExitProcess VirtualAllocEx CreateThread QueryPerformanceFrequency GetCurrentThread K32GetModuleFileNameExA DuplicateHandle GetVolumeInformationA GetProcessId TerminateProcess VirtualProtect GetCurrentProcessId FreeLibrary GetProcAddress LoadLibraryA LCMapStringEx DecodePointer EncodePointer GetStringTypeW GetExitCodeThread GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetTempPathW SetFileInformationByHandle GetFileInformationByHandle GetFileAttributesW FindNextFileW FindFirstFileExW FindClose GetCurrentDirectoryW GetLocaleInfoEx SleepConditionVariableSRW GetModuleHandleA WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete GetSystemTimePreciseAsFileTime GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetCurrentThreadId RaiseException WaitForSingleObjectEx SleepConditionVariableCS WakeConditionVariable FormatMessageA WaitForMultipleObjects PeekNamedPipe LoadLibraryExA VirtualAlloc DeviceIoControl VirtualFree GetTickCount64 GetEnvironmentVariableW LocalFree LocalAlloc K32EnumProcesses K32EmptyWorkingSet GetCurrentProcess VirtualQueryEx GetFileTime ReadProcessMemory GetSystemInfo CloseHandle Process32FirstW FileTimeToSystemTime CreateFileA GetFileType GetStdHandle VerifyVersionInfoW GetModuleHandleW GetEnvironmentVariableA SetLastError InitializeConditionVariable MoveFileExW GetFullPathNameW CreateFileW SleepEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection Process32NextW CreateToolhelp32Snapshot OpenProcess QueryDosDeviceA WriteProcessMemory GetModuleFileNameA AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile GetProcessHeap HeapFree HeapReAlloc HeapAlloc ReadFile GetFileSizeEx

user32

GetWindowTextLengthA GetClientRect EnumWindows GetWindowTextA FindWindowA GetDC ClientToScreen IsWindowVisible GetForegroundWindow GetAsyncKeyState mouse_event SetWindowDisplayAffinity SetForegroundWindow GetSystemMetrics PostQuitMessage PeekMessageA TranslateMessage EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode SetCursor SetCapture GetKeyboardLayout TrackMouseEvent GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo GetKeyState ReleaseDC UpdateWindow SetClipboardData GetWindowThreadProcessId GetClipboardData DispatchMessageA DestroyWindow SetWindowPos PostMessageA CallNextHookEx UnregisterClassW RegisterClassExW ShowWindow SetWindowLongA SetWindowsHookExA UnhookWindowsHookEx SetLayeredWindowAttributes DefWindowProcA

gdi32

BitBlt CreateCompatibleBitmap SelectObject DeleteObject CreateCompatibleDC

advapi32

CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW QueryServiceStatusEx OpenServiceW OpenSCManagerA CloseServiceHandle OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges GetUserNameW AddAccessAllowedAceEx InitializeAcl GetNamedSecurityInfoW SetNamedSecurityInfoW GetAce GetAclInformation SetEntriesInAclW RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCloseKey OpenServiceA ControlService QueryServiceStatus GetTokenInformation DuplicateTokenEx SetThreadToken GetUserNameA SetTokenInformation PrivilegeCheck RegGetValueA RevertToSelf CreateProcessAsUserA

shell32

SHGetFolderPathW

ole32

CoInitializeEx CreateStreamOnHGlobal

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

dxgi

CreateDXGIFactory

ntdll

RtlAnsiStringToUnicodeString ZwReadVirtualMemory NtQuerySystemInformation RtlPcToFileHeader ZwWriteVirtualMemory RtlInitAnsiString NtSetSystemInformation

ws2_32

send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent getpeername WSAWaitForMultipleEvents WSAGetLastError ntohs WSACleanup accept bind closesocket getsockopt connect getsockname htons recv setsockopt socket WSASetLastError WSAIoctl __WSAFDIsSet select getaddrinfo freeaddrinfo listen htonl recvfrom sendto ioctlsocket gethostname WSAStartup

crypt32

CertFreeCertificateChain CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertFreeCRLContext CertAddCertificateContextToStore CertFreeCTLContext CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain

gdiplus

GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdiplusStartup GdipGetImageEncodersSize GdipAlloc

shlwapi

PathFindFileNameA

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

bcrypt

BCryptGenRandom

secur32

InitSecurityInterfaceW

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

958KB

Virtual Size

958KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_b6ac1e726ccd7e33f95467048cfe847c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_remcos_satacom_stealc

PE Signature issue

iphlpapi

d3dx9_43

d3d11

kernel32

user32

gdi32

advapi32

shell32

ole32

d3dx11_43

dxgi

ntdll

ws2_32

crypt32

gdiplus

shlwapi

imm32

d3dcompiler_43

dwmapi

bcrypt

secur32

generic