f4a8859a39f0718c5d2c7a263238657f446904404a551a113d31b554b235e7cd

General

Target
2026-07-02_308591e1f8da96ae556a091306aeccd2_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 17.9MB
Sample260702-n2bt3sfx9m
SHA256 f4a8859a39f0718c5d2c7a263238657f446904404a551a113d31b554b235e7cd
MD5 308591e1f8da96ae556a091306aeccd2
SHA1 2e9b9168ef6a41834d7c32a7697f0a9a6a2ebebe
SHA512 88071d928748cbfe367e147ea53466c7a15eabb4b7fd387b1fde307e258e52542b3369644c7ba062df3cb9d037cc1c089c2673419b07cc92f8eadb30cef3fc26
SSDEEP 393216:p85vzo6mdOzLNAwtPxgu2W+eGQR59jom3BGcKmmOfw:u5vzo6LGw1j2W+e5R59MmXw
TLSH
T1F71733D5E3C485E8D8B38A35C6A64146E973AC25573CCADB8B25F9D23C333C1893E661
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-02_308591e1f8da96ae556a091306aeccd2_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 17.9MB
- SHA256 f4a8859a39f0718c5d2c7a263238657f446904404a551a113d31b554b235e7cd
- MD5 308591e1f8da96ae556a091306aeccd2
- SHA1 2e9b9168ef6a41834d7c32a7697f0a9a6a2ebebe
- SHA512 88071d928748cbfe367e147ea53466c7a15eabb4b7fd387b1fde307e258e52542b3369644c7ba062df3cb9d037cc1c089c2673419b07cc92f8eadb30cef3fc26
- SSDEEP 393216:p85vzo6mdOzLNAwtPxgu2W+eGQR59jom3BGcKmmOfw:u5vzo6LGw1j2W+e5R59MmXw
- TLSH
  T1F71733D5E3C485E8D8B38A35C6A64146E973AC25573CCADB8B25F9D23C333C1893E661
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion execution persistence spyware stealer adware ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2