cstealer | a9ce3c3cd72ecf40f91d08060b66dd2fa1327a685a44d0bd46e227f265d3697a

General

Target
2026-07-12_ef57257363dcd7141e3ef8c63e27b82a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 19.2MB
Sample260712-xplcesfx4j
SHA256 a9ce3c3cd72ecf40f91d08060b66dd2fa1327a685a44d0bd46e227f265d3697a
MD5 ef57257363dcd7141e3ef8c63e27b82a
SHA1 85cb9183313ee9e51b6d1bdfb6f5aecf6d3f0663
SHA512 fc90b9e2192743a891bfed3e868345b14322c2aa09929c1c9c9477066f2e76fa5a6b13e0b16db4202b0eeee5c2b8c0235693f89b3233120533bf270c2b1a363b
SSDEEP 393216:T85vz3ip6no63hucn1+TtIiF6CuARuA2LcFXmbetH41AJhwokNVsSNUUcS:w5vz1J3hrn1QtILCuAj8gH4yw3NumUw
TLSH
T1A31733FA12A104DBE8F6513A43EAC0BDD721E99AC761D5CF07902D536E5BAE4083BF50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-12_ef57257363dcd7141e3ef8c63e27b82a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 19.2MB
- SHA256 a9ce3c3cd72ecf40f91d08060b66dd2fa1327a685a44d0bd46e227f265d3697a
- MD5 ef57257363dcd7141e3ef8c63e27b82a
- SHA1 85cb9183313ee9e51b6d1bdfb6f5aecf6d3f0663
- SHA512 fc90b9e2192743a891bfed3e868345b14322c2aa09929c1c9c9477066f2e76fa5a6b13e0b16db4202b0eeee5c2b8c0235693f89b3233120533bf270c2b1a363b
- SSDEEP 393216:T85vz3ip6no63hucn1+TtIiF6CuARuA2LcFXmbetH41AJhwokNVsSNUUcS:w5vz1J3hrn1QtILCuAj8gH4yw3NumUw
- TLSH
  T1A31733FA12A104DBE8F6513A43EAC0BDD721E99AC761D5CF07902D536E5BAE4083BF50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery persistence spyware stealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Indicator Removal: Network Share Connection Removal
  Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates a new local user account
  Uses net.exe to create a new local user account, often for persistence or a backdoor account.
  persistence
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2