2026-07-01_0a0a0cd1177a03ae8581e37be545a4c0_blankgrabber_cobalt-strike_icedid_satacom_stealc

General

Target
2026-07-01_0a0a0cd1177a03ae8581e37be545a4c0_blankgrabber_cobalt-strike_icedid_satacom_stealc
Size 221KB
Sample260702-athe1agy5l
SHA256 818b1ed375a3de4372d41de6b1ee1d12dd5749b222fc95bd9fcbdbf6f626cf52
MD5 0a0a0cd1177a03ae8581e37be545a4c0
SHA1 05358b753b3c007d1eda4db1d67423c718de239e
SHA512 44af7eefd91bfe380ceaa909df12a1b7cb92c09d0546033fcab66fc8fd50643aa1bd4584be75166ce4af44c1231de8f62a8b2fc8d1970db7dd3d0bd986cb4dc7
SSDEEP 3072:C1f0GXgdckl0u5LBjpEXZWkGz3ZE431QFcf3BchTNsYAIU0gQ5Y1smS9:Dz0uHjwWBqECHxNsYPhm
TLSH
T1BE243A96E57259E5D9BBC039C5426606FE613C598320B7DB9B904B974F23BE0EE3E300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-01_0a0a0cd1177a03ae8581e37be545a4c0_blankgrabber_cobalt-strike_icedid_satacom_stealc

File Explorer

2026-07-01_0a0a0cd1177a03ae8581e37be545a4c0_blankgrabber_cobalt-strike_icedid_satacom_stealc

.exe 221KB

2026-07-01_0a0a0cd1177a03ae8581e37be545a4c0_blankgrabber_cobalt-strike_icedid_satacom_stealc

IMPHASH 8da3eaaa43d57385db63878e3101f267
SHA256 818b1ed375a3de4372d41de6b1ee1d12dd5749b222fc95bd9fcbdbf6f626cf52
MD5 0a0a0cd1177a03ae8581e37be545a4c0
SHA1 05358b753b3c007d1eda4db1d67423c718de239e
SHA512 44af7eefd91bfe380ceaa909df12a1b7cb92c09d0546033fcab66fc8fd50643aa1bd4584be75166ce4af44c1231de8f62a8b2fc8d1970db7dd3d0bd986cb4dc7
SSDEEP 3072:C1f0GXgdckl0u5LBjpEXZWkGz3ZE431QFcf3BchTNsYAIU0gQ5Y1smS9:Dz0uHjwWBqECHxNsYPhm
TLSH
T1BE243A96E57259E5D9BBC039C5426606FE613C598320B7DB9B904B974F23BE0EE3E300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

71312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\!! MSVC Projects\! STUB FIXING\newstubNative - copy\main\x64\Release\main.pdb

kernel32

VirtualAlloc AddVectoredExceptionHandler VirtualProtect GetModuleHandleA GetProcAddress LoadLibraryA WriteConsoleW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetStringTypeW SetStdHandle GetFileType GetProcessHeap SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW IsProcessorFeaturePresent HeapFree HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW LoadLibraryExW CompareStringW LCMapStringW

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse

bcrypt

BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptDeriveKeyPBKDF2

Name

.text

Size

137KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_0a0a0cd1177a03ae8581e37be545a4c0_blankgrabber_cobalt-strike_icedid_satacom_stealc

kernel32

winhttp

bcrypt

generic