2026-07-09_120fcfc37f9f5bbf259549e1f3ae8b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_120fcfc37f9f5bbf259549e1f3ae8b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 2.2MB
Sample260709-wpqfpsfs9r
SHA256 b46e1f6f482678ed43b21a0d7a8b3d3acab39ddaa7be30b7cb61ccef51c799c3
MD5 120fcfc37f9f5bbf259549e1f3ae8b25
SHA1 2dad7b1af61c3ec5c951672b0de3ecb366ee241a
SHA512 9207c5b3d5b445a00bf5d099f869afd9c00c179b7ee660b224aa18a3de3f39809f3e42734fcedea73f010865edaba691173c2111315b27822578705ea117cc63
SSDEEP 49152:gC+ZsnP+byIF28JQ6wKK1kharXB2NIydr7R+JaurnX7tTE1:GZl9RKXB2NIydr7R+J/nE
TLSH
T153B53A156ED401CAEE731D3CCB4587CBE5AE7D08032062B796E98A5036730DA5DBAB73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_120fcfc37f9f5bbf259549e1f3ae8b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-07-09_120fcfc37f9f5bbf259549e1f3ae8b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 2.2MB

2026-07-09_120fcfc37f9f5bbf259549e1f3ae8b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 9089d242b23dd9515d9f293236d6323c
SHA256 b46e1f6f482678ed43b21a0d7a8b3d3acab39ddaa7be30b7cb61ccef51c799c3
MD5 120fcfc37f9f5bbf259549e1f3ae8b25
SHA1 2dad7b1af61c3ec5c951672b0de3ecb366ee241a
SHA512 9207c5b3d5b445a00bf5d099f869afd9c00c179b7ee660b224aa18a3de3f39809f3e42734fcedea73f010865edaba691173c2111315b27822578705ea117cc63
SSDEEP 49152:gC+ZsnP+byIF28JQ6wKK1kharXB2NIydr7R+JaurnX7tTE1:GZl9RKXB2NIydr7R+J/nE
TLSH
T153B53A156ED401CAEE731D3CCB4587CBE5AE7D08032062B796E98A5036730DA5DBAB73
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1784016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptGenRandom

crypt32

CertGetNameStringW CertGetCertificateChain CertFreeCertificateChain CertFindExtension CertCreateCertificateChainEngine CryptQueryObject CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateChainEngine

secur32

InitSecurityInterfaceW

ws2_32

ioctlsocket sendto recvfrom listen htonl freeaddrinfo getaddrinfo select __WSAFDIsSet WSAIoctl gethostname socket setsockopt recv ntohs htons getsockname getpeername connect closesocket bind accept WSACleanup WSAStartup WSAGetLastError WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt WSASetLastError

advapi32

CryptReleaseContext CryptGetHashParam CryptCreateHash CryptAcquireContextA RegQueryValueExW RegOpenKeyExW RegCloseKey RegOpenKeyExA RegQueryValueExA CryptAcquireContextW SystemFunction036 CryptDestroyHash CryptHashData

iphlpapi

if_nametoindex GetAdaptersInfo

kernel32

SetStdHandle GetCurrentDirectoryW DeleteFileW HeapReAlloc GetTimeZoneInformation FlushFileBuffers GetFileAttributesExW GetExitCodeProcess WaitForSingleObject EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW HeapFree HeapAlloc UnhandledExceptionFilter SetEndOfFile IsValidCodePage GetACP GetOEMCP FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW HeapSize InitializeCriticalSectionEx SetConsoleTextAttribute GetStdHandle GetCurrentThreadId GetModuleHandleA Sleep GetTickCount64 ExitProcess GetCurrentProcessId GetTickCount GetModuleFileNameA GetCommandLineW ExpandEnvironmentStringsA CopyFileA CloseHandle GetProcAddress LocalFree WideCharToMultiByte CreateProcessA ReadFile GetFileSizeEx CreateFileA GetModuleHandleExW VirtualProtect SetDefaultDllDirectories GetFullPathNameW GetCurrentProcess TerminateProcess GetModuleFileNameW GetSystemDirectoryW DuplicateHandle SetProcessMitigationPolicy CreateToolhelp32Snapshot Process32NextW GetCurrentThread Process32FirstW RaiseException Module32FirstW GetThreadContext GetWindowsDirectoryW CreateProcessW Module32NextW lstrcmpiW CheckRemoteDebuggerPresent GetConsoleScreenBufferInfo SetConsoleTitleA GetSystemFirmwareTable DeviceIoControl GetVolumeInformationA GetComputerNameA ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepEx EnterCriticalSection LeaveCriticalSection RtlUnwind DeleteCriticalSection QueryPerformanceCounter QueryPerformanceFrequency InitializeConditionVariable GetLastError SetLastError CreateFileW MoveFileExW MultiByteToWideChar GetEnvironmentVariableA GetModuleHandleW VerSetConditionMask VerifyVersionInfoW GetFileType PeekNamedPipe WaitForMultipleObjects FormatMessageA WakeConditionVariable SleepConditionVariableCS WaitForSingleObjectEx CreateThread GetSystemInfo InitializeCriticalSection IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineA IsProcessorFeaturePresent SetFilePointerEx GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetSystemTimePreciseAsFileTime GetExitCodeThread WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader FlsAlloc FlsGetValue FlsSetValue FlsFree ExitThread FreeLibrary FreeLibraryAndExitThread GetDriveTypeW GetFileInformationByHandle

user32

wsprintfW FindWindowA GetSystemMetrics GetCursorPos

shell32

CommandLineToArgvW ShellExecuteExA

vmprotectsdk64

VMProtectBeginUltra VMProtectEnd

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

277KB

Virtual Size

277KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_120fcfc37f9f5bbf259549e1f3ae8b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

bcrypt

crypt32

secur32

ws2_32

advapi32

iphlpapi

kernel32

user32

shell32

vmprotectsdk64

generic