2b466d8674638be5457ae68f98545028ce22e17391a52bd09a1f9df41e4873b7

General

Target
2026-07-15_03ca23ac609f12b0f4209d810a540933_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 13.1MB
Sample260716-cpybrsew4w
SHA256 2b466d8674638be5457ae68f98545028ce22e17391a52bd09a1f9df41e4873b7
MD5 03ca23ac609f12b0f4209d810a540933
SHA1 fe362cccc28623ab558bb4bbb54710285b2a2be3
SHA512 335f5a76e38db5f48eeb925e3a78cdac56586f156d33bb8f772655c0077f510c83b256b0d543dedd10bed4291b227e56c4e2e0e2834f7c5fb63adf6e0bf8d421
SSDEEP 393216:6hL6ntXEAphVtpIwQSg+HOctTLvF7dupljN:K+tRphFBo+uctHvF7CN
TLSH
T140D633A8B3904AFAE8F7943D59A2C610E2B1B5502F91D2FF07F01B142D3F9848D7D6A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-07-15_03ca23ac609f12b0f4209d810a540933_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 13.1MB
- SHA256 2b466d8674638be5457ae68f98545028ce22e17391a52bd09a1f9df41e4873b7
- MD5 03ca23ac609f12b0f4209d810a540933
- SHA1 fe362cccc28623ab558bb4bbb54710285b2a2be3
- SHA512 335f5a76e38db5f48eeb925e3a78cdac56586f156d33bb8f772655c0077f510c83b256b0d543dedd10bed4291b227e56c4e2e0e2834f7c5fb63adf6e0bf8d421
- SSDEEP 393216:6hL6ntXEAphVtpIwQSg+HOctTLvF7dupljN:K+tRphFBo+uctHvF7CN
- TLSH
  T140D633A8B3904AFAE8F7943D59A2C610E2B1B5502F91D2FF07F01B142D3F9848D7D6A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution pyinstaller
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

1

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Drops startup file

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2