General
- Target 2026-07-17_57697c920161b7cf82b3a822210c937b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 27.2MB
- Sample260717-vlv2cabz91
- SHA256 95842a28f7b4c962f3c29a153d533038837e7d5a4e04b487de87979c48a4de33
- MD5 57697c920161b7cf82b3a822210c937b
- SHA1 60dea8415f5884f87194b946feab2c2d4f1cab92
- SHA512 ba10a624b33bb2af923b5c58a58900f4d86cbc9d1469a261741735274dacff5becdf0f9829158692251bc8ff41164abfa3de24c46f3eaedcb766d4b04d3f554a
- SSDEEP 786432:nvUMOtz7LW8cwRW5YFrHFFuQEWFUhk2AaxEdYTQnpL523d24N:nvUMOtPLWAiYFzFFuQJFyk2AeQR6DN
- TLSH T14C573385BA610089C9574A74E8D28C31EAA7B8F313B483C71BF54D561E878DEEF79B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-07-17_57697c920161b7cf82b3a822210c937b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_57697c920161b7cf82b3a822210c937b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-17_57697c920161b7cf82b3a822210c937b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 27.2MB
- SHA256 95842a28f7b4c962f3c29a153d533038837e7d5a4e04b487de87979c48a4de33
- MD5 57697c920161b7cf82b3a822210c937b
- SHA1 60dea8415f5884f87194b946feab2c2d4f1cab92
- SHA512 ba10a624b33bb2af923b5c58a58900f4d86cbc9d1469a261741735274dacff5becdf0f9829158692251bc8ff41164abfa3de24c46f3eaedcb766d4b04d3f554a
- SSDEEP 786432:nvUMOtz7LW8cwRW5YFrHFFuQEWFUhk2AaxEdYTQnpL523d24N:nvUMOtPLWAiYFzFFuQJFyk2AeQR6DN
- TLSH T14C573385BA610089C9574A74E8D28C31EAA7B8F313B483C71BF54D561E878DEEF79B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Drops startup file
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.