0bcec918a0426a0c5cc7be5c805840e79129cba9fc78e069c72928da8760c9e5

General

Target
2026-07-02_4c132b50f5895036a71a99fcd95d6f09_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 32.7MB
Sample260702-cm2leahw5n
SHA256 0bcec918a0426a0c5cc7be5c805840e79129cba9fc78e069c72928da8760c9e5
MD5 4c132b50f5895036a71a99fcd95d6f09
SHA1 51a8b40ac5b41ffb8c86607c138b83f368066335
SHA512 cd36e45810c90d4282aff522f8998bfad5cf2d98b784acefe360e53d54b05938146d829939665af95a8ed2b8baae0ef009a23595d38b0d9c6014d7c9ffa6c8db
SSDEEP 786432:mG+g+kYCQbwanW89Nc6OjTNGCgXpNKz0tthYm4Mf5thaE:pvqwanWyNc6K4h/ttmm/Na
TLSH
T12B7733817F8448EDD44A523C8990CB6316A178DA4378C4E78AFD984B1DB36E1BF3DB91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-02_4c132b50f5895036a71a99fcd95d6f09_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 32.7MB
- SHA256 0bcec918a0426a0c5cc7be5c805840e79129cba9fc78e069c72928da8760c9e5
- MD5 4c132b50f5895036a71a99fcd95d6f09
- SHA1 51a8b40ac5b41ffb8c86607c138b83f368066335
- SHA512 cd36e45810c90d4282aff522f8998bfad5cf2d98b784acefe360e53d54b05938146d829939665af95a8ed2b8baae0ef009a23595d38b0d9c6014d7c9ffa6c8db
- SSDEEP 786432:mG+g+kYCQbwanW89Nc6OjTNGCgXpNKz0tthYm4Mf5thaE:pvqwanWyNc6K4h/ttmm/Na
- TLSH
  T12B7733817F8448EDD44A523C8990CB6316A178DA4378C4E78AFD984B1DB36E1BF3DB91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery persistence spyware stealer ransomware
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Indicator Removal: Network Share Connection Removal
  Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
  defense_evasion
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2