fe03f6c04873fe57d211cdae4b3179bbb09d2caa43bbf0a489a4ccefa9914cc7

General

Target
2026-07-08_7c548bef825a0cd632a416bc8d942f96_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 85.4MB
Sample260708-e4jg9say6t
SHA256 fe03f6c04873fe57d211cdae4b3179bbb09d2caa43bbf0a489a4ccefa9914cc7
MD5 7c548bef825a0cd632a416bc8d942f96
SHA1 d0dbf458f35a4d582af370c8b30e975ff5c363ca
SHA512 709ecd334936bd0693da7c1f11da188fddcd18c9b5c6648a2135dd1f91ba38402775717878051a14acba30882eec1dfcc3856a2a25a87a3a9d9cfafb37ea772b
SSDEEP 1572864:tvUMOtPW1a7KZq+dy2J0f0/rBdsG7bpip0WWRiIjK4cNhZuPgDU:RUXZCa7KYI5BB7tE0WkG4cb8P5
TLSH
T1BA1833699461102BF74E833293E6D67B7BE2164EC76980CD1AC89F475BA71C9CC3AC13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-08_7c548bef825a0cd632a416bc8d942f96_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 85.4MB
- SHA256 fe03f6c04873fe57d211cdae4b3179bbb09d2caa43bbf0a489a4ccefa9914cc7
- MD5 7c548bef825a0cd632a416bc8d942f96
- SHA1 d0dbf458f35a4d582af370c8b30e975ff5c363ca
- SHA512 709ecd334936bd0693da7c1f11da188fddcd18c9b5c6648a2135dd1f91ba38402775717878051a14acba30882eec1dfcc3856a2a25a87a3a9d9cfafb37ea772b
- SSDEEP 1572864:tvUMOtPW1a7KZq+dy2J0f0/rBdsG7bpip0WWRiIjK4cNhZuPgDU:RUXZCa7KYI5BB7tE0WkG4cb8P5
- TLSH
  T1BA1833699461102BF74E833293E6D67B7BE2164EC76980CD1AC89F475BA71C9CC3AC13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution persistence ransomware adware spyware
- Modifies WinLogon for persistence
  persistence
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VirtualBox drivers on disk
  defense_evasion
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Enumerates processes with tasklist
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2