General
- Target 2026-07-04_94e28f0dc4743183c66ed6c7cab1f2c1_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc
- Size 15.0MB
- Sample260704-erj82ae12k
- SHA256 d5e43c8649cdd5af912da2449bb10f6e1486e0dec0d1a96f231832832ebda7e1
- MD5 94e28f0dc4743183c66ed6c7cab1f2c1
- SHA1 b1fbf07dee7d765a18e3a1b56da4ac6165afc739
- SHA512 499c6d77f7d95d7cf5e065f9b1bd2a220a8f3a87e42f061449f0ede1e51c2918fe8b87ed5c41848bf2b49806f84ffe0d52b7209edae49b54cbe474fe94c22ae5
- SSDEEP 393216:h2OtaU4Hqo/P4epeR9wXWw3ydeT2x9OUY:0Zxc9
- TLSH T15BF6AEA9B6B800D5E867C1BCC2965223E772B45523B057CF5A649AF60F23BD02E7F740
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-04_94e28f0dc4743183c66ed6c7cab1f2c1_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_94e28f0dc4743183c66ed6c7cab1f2c1_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260629-en
19 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-04_94e28f0dc4743183c66ed6c7cab1f2c1_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc
- Size 15.0MB
- SHA256 d5e43c8649cdd5af912da2449bb10f6e1486e0dec0d1a96f231832832ebda7e1
- MD5 94e28f0dc4743183c66ed6c7cab1f2c1
- SHA1 b1fbf07dee7d765a18e3a1b56da4ac6165afc739
- SHA512 499c6d77f7d95d7cf5e065f9b1bd2a220a8f3a87e42f061449f0ede1e51c2918fe8b87ed5c41848bf2b49806f84ffe0d52b7209edae49b54cbe474fe94c22ae5
- SSDEEP 393216:h2OtaU4Hqo/P4epeR9wXWw3ydeT2x9OUY:0Zxc9
- TLSH T15BF6AEA9B6B800D5E867C1BCC2965223E772B45523B057CF5A649AF60F23BD02E7F740
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.