4416bedb848cb8c19fa64c5ca1d541334da7c75ee8cf1d9b9ae9aaf8d916c357 | Triage™

Login
Reports

Overview

overview

Static

static

2026-07-17...om.exe

windows10-2004-x64

9

2026-07-17...om.exe

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-17_3a30301eaa000f809632e59a2d0309de_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 16.7MB
Sample260717-becrmsgz8m
SHA256 4416bedb848cb8c19fa64c5ca1d541334da7c75ee8cf1d9b9ae9aaf8d916c357
MD5 3a30301eaa000f809632e59a2d0309de
SHA1 c4782abb043b971e4fed32620ac0ebbd5c7e2bfa
SHA512 ff3f461b6e62ef43e0da6ea92611b23bde3dac962b484d601e42a3d88d450ca1007bc5e27990f63a547b3d3ce0e272a1e3b19e80b63b6c73e93755fee4e25fb9
SSDEEP 393216:10Pd1F2jXEAphVtpIwQSg+sgeXjGa11C82exD+SNc7fa4wjQWl:eXsjRphFBo+5ajGa11CaV+SO7nK9
TLSH
T1BD0733A977781CA9E09B813CA5C5CE2A93F1B0923B64C7AB6BF14D140D675C0DE74BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution pyinstaller

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

2026-07-17_3a30301eaa000f809632e59a2d0309de_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

18 signatures

150 seconds

defense_evasion discovery execution

Behavioral task

behavioral2

Sample

2026-07-17_3a30301eaa000f809632e59a2d0309de_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

18 signatures

150 seconds

defense_evasion discovery execution

Malware Config

Targets

- Target
  2026-07-17_3a30301eaa000f809632e59a2d0309de_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 16.7MB
- SHA256 4416bedb848cb8c19fa64c5ca1d541334da7c75ee8cf1d9b9ae9aaf8d916c357
- MD5 3a30301eaa000f809632e59a2d0309de
- SHA1 c4782abb043b971e4fed32620ac0ebbd5c7e2bfa
- SHA512 ff3f461b6e62ef43e0da6ea92611b23bde3dac962b484d601e42a3d88d450ca1007bc5e27990f63a547b3d3ce0e272a1e3b19e80b63b6c73e93755fee4e25fb9
- SSDEEP 393216:10Pd1F2jXEAphVtpIwQSg+sgeXjGa11C82exD+SNc7fa4wjQWl:eXsjRphFBo+5ajGa11CaV+SO7nK9
- TLSH
  T1BD0733A977781CA9E09B813CA5C5CE2A93F1B0923B64C7AB6BF14D140D675C0DE74BE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Loads dropped DLL
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

System Time Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryexecution

behavioral2

defense_evasiondiscoveryexecution

© 2018-2026

Terms | Privacy