General
- Target 2026-07-06_20cfcc52229dd14be62eb611e91f3fb8_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 39.7MB
- Sample260706-dw8xhsds2l
- SHA256 fb4da51ed97088d0e915d2c9516f888fd556a8520858d2b7a6870813eb766d1a
- MD5 20cfcc52229dd14be62eb611e91f3fb8
- SHA1 df9f9c93c511ea84b02a812bdc8c8fb9abef6590
- SHA512 4d320a1b329125fe85e68dd23913369dfc938d0e4fb70a2ae2fd50a8ad67b75d1841fa38551436be367c23fab0a0ba68c62ea7de5dc4194b8c1ad60f40e3c4b5
- SSDEEP 786432:E2G4TLcNOBV/vFRphFBo+/ruODO/68hKvBaxOO1UyjPJPaj/kAvS7fP:zTIAnFPhJo/6ZowYDYAfP
- TLSH T1779733583BA1E98DF32D8D3D5CD1D76D6AE562B25E14C6431B7008D12F3378C6EE0AA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-06_20cfcc52229dd14be62eb611e91f3fb8_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-06_20cfcc52229dd14be62eb611e91f3fb8_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260629-en
Malware Config
Targets
-
- Target 2026-07-06_20cfcc52229dd14be62eb611e91f3fb8_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 39.7MB
- SHA256 fb4da51ed97088d0e915d2c9516f888fd556a8520858d2b7a6870813eb766d1a
- MD5 20cfcc52229dd14be62eb611e91f3fb8
- SHA1 df9f9c93c511ea84b02a812bdc8c8fb9abef6590
- SHA512 4d320a1b329125fe85e68dd23913369dfc938d0e4fb70a2ae2fd50a8ad67b75d1841fa38551436be367c23fab0a0ba68c62ea7de5dc4194b8c1ad60f40e3c4b5
- SSDEEP 786432:E2G4TLcNOBV/vFRphFBo+/ruODO/68hKvBaxOO1UyjPJPaj/kAvS7fP:zTIAnFPhJo/6ZowYDYAfP
- TLSH T1779733583BA1E98DF32D8D3D5CD1D76D6AE562B25E14C6431B7008D12F3378C6EE0AA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
UAC bypass
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables use of System Restore points
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1