General
- Target 2026-07-10_ad13ed833110b50fdd7a9b436666564a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 134.9MB
- Sample260710-brgw5acy51
- SHA256 c87690f9171d5c1ecea3568d277e28ce6c9c7120882d27bd3dd8b04924af054b
- MD5 ad13ed833110b50fdd7a9b436666564a
- SHA1 4fa7e6d67accb25b6c5c72a4b0200b69702d6883
- SHA512 e5ee64d9c67f1c99b349780a82e7028faf214cd2578728aa224f984289a608dbfec51a4e89d2625bb40c09c91b1deb7addaccaef3327050a241bc4c5b5ee3032
- SSDEEP 3145728:IKfTEHXOJ4gwGBgAKeU790FzW9Vx9XK+KTT/bK63+UZi:IpOJvwcKh9096Vx8+uT+sBZi
- TLSH T1706833746660197AF1D1FD3ED9D2F730B29AA6513BB3548B1B822270284F9CE4EF1B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Behavioral task
behavioral1
Sample
2026-07-10_ad13ed833110b50fdd7a9b436666564a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_ad13ed833110b50fdd7a9b436666564a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_ad13ed833110b50fdd7a9b436666564a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 134.9MB
- SHA256 c87690f9171d5c1ecea3568d277e28ce6c9c7120882d27bd3dd8b04924af054b
- MD5 ad13ed833110b50fdd7a9b436666564a
- SHA1 4fa7e6d67accb25b6c5c72a4b0200b69702d6883
- SHA512 e5ee64d9c67f1c99b349780a82e7028faf214cd2578728aa224f984289a608dbfec51a4e89d2625bb40c09c91b1deb7addaccaef3327050a241bc4c5b5ee3032
- SSDEEP 3145728:IKfTEHXOJ4gwGBgAKeU790FzW9Vx9XK+KTT/bK63+UZi:IpOJvwcKh9096Vx8+uT+sBZi
- TLSH T1706833746660197AF1D1FD3ED9D2F730B29AA6513BB3548B1B822270284F9CE4EF1B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application