Extracted

• • Target
    2026-07-08_a7d35ef503f23255a9a18709bf7595e7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
  • Size 11.3MB
  • SHA256 88ffbfbdd26e8bb3b4907b805753d54cfd00d498c59d1bd9f64f62b6792e130e
  • MD5 a7d35ef503f23255a9a18709bf7595e7
  • SHA1 dcf9ae7656a7fc22592a7e46d06d90edbc864078
  • SHA512 4779d8e4d891f47458b0e8d6bb3c0af99317a66aa1619a37edc533475aad9bf89bb2eee905e7bf447a7715bd2e739681a051f98dab1b7993a84b4665b7498058
  • SSDEEP 196608:973ic5zujxPK+kcAlhcd3wLw3XEpXnH2ph1iut1/1QpL0uQg+RGtK7voKgpVFSZ:ZXzSJKDcAlhAEw3XEAphVtrQSg+R2K7p
  • TLSH
    T176C6336CA2A419F9E8B3803CAE95D521B2727C512F55D2F703E09D1A2E3F2E14E78774
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  costuraexecutionratonratpackerpersistencestealeradwareransomwarespyware

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Detects executables manipulated with Fody

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2