f676ac0069b939fba01c020fbb00b28cc84b10f00928967537c2e0e5981e9ec0

General

Target
2026-07-14_a4234f04cb59c5fa191b087ae181abce_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 50.0MB
Sample260714-dxbcmsds8k
SHA256 f676ac0069b939fba01c020fbb00b28cc84b10f00928967537c2e0e5981e9ec0
MD5 a4234f04cb59c5fa191b087ae181abce
SHA1 6bd616b93bfb714529ceb4e48a64d6418ac4510f
SHA512 7f40443d618c34f5be25f230b494ff9d64a7a67a0d50018d36f07bc50964ac0e451cf90d18ed78ba25304c9ed71c8347d4514cb454212dd909962f6acfb63763
SSDEEP 1572864:QKXz8jS3WFHnzbWm6/UC8GcieR9Oh5CQf5Z:rXwW6HnzbWBT8GDeR9o5CA5Z
TLSH
T186B73399339414D7F8CAC23EB1EBD46388C1FA791746C18B82B0652319632D5FEBAF15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-14_a4234f04cb59c5fa191b087ae181abce_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 50.0MB
- SHA256 f676ac0069b939fba01c020fbb00b28cc84b10f00928967537c2e0e5981e9ec0
- MD5 a4234f04cb59c5fa191b087ae181abce
- SHA1 6bd616b93bfb714529ceb4e48a64d6418ac4510f
- SHA512 7f40443d618c34f5be25f230b494ff9d64a7a67a0d50018d36f07bc50964ac0e451cf90d18ed78ba25304c9ed71c8347d4514cb454212dd909962f6acfb63763
- SSDEEP 1572864:QKXz8jS3WFHnzbWm6/UC8GcieR9Oh5CQf5Z:rXwW6HnzbWBT8GDeR9o5CA5Z
- TLSH
  T186B73399339414D7F8CAC23EB1EBD46388C1FA791746C18B82B0652319632D5FEBAF15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution exploit persistence privilege_escalation
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2