7248135964935b6ef2505376921921b26a561cdd9372c2cedf6c9d6b4cf78bea

General

Target
2026-07-16_2ebfadb549e537574b9e2f11167ee1d4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 8.6MB
Sample260716-yhr23act7n
SHA256 7248135964935b6ef2505376921921b26a561cdd9372c2cedf6c9d6b4cf78bea
MD5 2ebfadb549e537574b9e2f11167ee1d4
SHA1 0cef72b95ff41d623ba0091bcae8719862967ad5
SHA512 aee293474b7e53495a2f43615ddd189499d219e43bc7256faa5434863e6f0dedc28080458611f49fc083ce8cee52fab5096c63c2389081a58338fd00fd9d617c
SSDEEP 196608:Thcd3wLLjXXEpXnH2ph1iut1/1QpL0uQg+RBtK7voKgpVFSZ:ThAE/XEAphVtrQSg+RHK7vFgtS
TLSH
T15296339CB3A016FEF8F3803D9DA5D411E6B3B8501B61D1FB17B089190E3B6D04E78AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-16_2ebfadb549e537574b9e2f11167ee1d4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 8.6MB
- SHA256 7248135964935b6ef2505376921921b26a561cdd9372c2cedf6c9d6b4cf78bea
- MD5 2ebfadb549e537574b9e2f11167ee1d4
- SHA1 0cef72b95ff41d623ba0091bcae8719862967ad5
- SHA512 aee293474b7e53495a2f43615ddd189499d219e43bc7256faa5434863e6f0dedc28080458611f49fc083ce8cee52fab5096c63c2389081a58338fd00fd9d617c
- SSDEEP 196608:Thcd3wLLjXXEpXnH2ph1iut1/1QpL0uQg+RBtK7voKgpVFSZ:ThAE/XEAphVtrQSg+RHK7vFgtS
- TLSH
  T15296339CB3A016FEF8F3803D9DA5D411E6B3B8501B61D1FB17B089190E3B6D04E78AA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

bootkit credential_access defense_evasion discovery evasion execution impact persistence ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (1205) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2