General
- Target 2026-07-09_ed2c4fedaa8356dd49e4d25b159441c7_blankgrabber_cobalt-strike_icedid_njrat_satacom
- Size 21.4MB
- Sample260709-xd894sf14n
- SHA256 46fc9fd658d12aa02c593eb9b08076b56b5e838f56a8b5e9caee4b64cc03e49a
- MD5 ed2c4fedaa8356dd49e4d25b159441c7
- SHA1 35c5b14eb429bb4d1fcfa2d782cb37586d533859
- SHA512 4e8b0833fb1cbb158513b29ac20702d560c987bf7565c88cbb005acda0ef8e9a7ebd38aa5ae3096918761d15bd95374ddfee44583b0e92d0df9056079db5dadd
- SSDEEP 393216:IpTF2HYB2LXFw+231woWk6F9XCvwtEXRMBXXhu38O7KVm8hVtenG3aNvor:STFopq+noWJLXg4EXCBXqGtzcv
- TLSH T11E373309F2950894E57E573AC4C73E9CA57E7C2147128AFF5D99E2A5BE271B00E38BC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_ed2c4fedaa8356dd49e4d25b159441c7_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_ed2c4fedaa8356dd49e4d25b159441c7_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_ed2c4fedaa8356dd49e4d25b159441c7_blankgrabber_cobalt-strike_icedid_njrat_satacom
- Size 21.4MB
- SHA256 46fc9fd658d12aa02c593eb9b08076b56b5e838f56a8b5e9caee4b64cc03e49a
- MD5 ed2c4fedaa8356dd49e4d25b159441c7
- SHA1 35c5b14eb429bb4d1fcfa2d782cb37586d533859
- SHA512 4e8b0833fb1cbb158513b29ac20702d560c987bf7565c88cbb005acda0ef8e9a7ebd38aa5ae3096918761d15bd95374ddfee44583b0e92d0df9056079db5dadd
- SSDEEP 393216:IpTF2HYB2LXFw+231woWk6F9XCvwtEXRMBXXhu38O7KVm8hVtenG3aNvor:STFopq+noWJLXg4EXCBXqGtzcv
- TLSH T11E373309F2950894E57E573AC4C73E9CA57E7C2147128AFF5D99E2A5BE271B00E38BC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
A stealer written in Python and packaged with Pyinstaller
-
Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.