General
- Target 2026-07-01_09713205fbd832acd8efa3eb634d31be_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 14.2MB
- Sample260701-mt5xhsb13n
- SHA256 e5f2e0a99acdd00de74f71f2fd6a6c03170b22d20103c6e3b5fb5b22b850412f
- MD5 09713205fbd832acd8efa3eb634d31be
- SHA1 a80de68e884868b587592dc2476fd21f37e6f928
- SHA512 bef811073d251db9a7899a4ec6341f8b20799ace720a5c16dc244fe345788001d31e01ebdca57050a682a639669e39a3b9037b98643615bf756ca67d11c88199
- SSDEEP 393216:3nW8IrDfDgZdLxm3+Hl30aoc6qE3+d9UyaL/rPS:3nW8Irb0DxmW30an4Od9AK
- TLSH T1E2E633A9F2980D88D4BBA33ED4D4962B66E275320794C6CB5BBC4B901C173D4FE7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-01_09713205fbd832acd8efa3eb634d31be_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_09713205fbd832acd8efa3eb634d31be_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260629-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_09713205fbd832acd8efa3eb634d31be_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 14.2MB
- SHA256 e5f2e0a99acdd00de74f71f2fd6a6c03170b22d20103c6e3b5fb5b22b850412f
- MD5 09713205fbd832acd8efa3eb634d31be
- SHA1 a80de68e884868b587592dc2476fd21f37e6f928
- SHA512 bef811073d251db9a7899a4ec6341f8b20799ace720a5c16dc244fe345788001d31e01ebdca57050a682a639669e39a3b9037b98643615bf756ca67d11c88199
- SSDEEP 393216:3nW8IrDfDgZdLxm3+Hl30aoc6qE3+d9UyaL/rPS:3nW8Irb0DxmW30an4Od9AK
- TLSH T1E2E633A9F2980D88D4BBA33ED4D4962B66E275320794C6CB5BBC4B901C173D4FE7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.