General
- Target 2026-07-19_cd7b1fc5b53b5b93c57ac130f1d5a516_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 70.6MB
- Sample260719-b5248ab14x
- SHA256 02ecc1a27bf560ab4b0d9ad5702d9b4e0eac01caeeabf411e3cc2da1aa64b722
- MD5 cd7b1fc5b53b5b93c57ac130f1d5a516
- SHA1 701dedf3020f1ffb7f37b03895d4f7c66a48bdd6
- SHA512 e945c567f8ee286eb6c56585eca5e9031e05f400e2fbba53b15c6a3b40bbb9c1b70fc4a1ca8d50335c2a4699caaf71149c776e6f52228074e6f6b3c38c28b3f9
- SSDEEP 1572864:o9zXW5+dy2J0f0/rBdsG7bpip0WWinGCnk/+BDOyf/c9NCK+/eDKDe:o9T4I5BB7tE0WZGCnk/3NC8Do
- TLSH T138F73358A95506A7F68A8232D4E3E8967BBA35068FA6C0CE0BD54D034B771C9DC7CC73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-07-19_cd7b1fc5b53b5b93c57ac130f1d5a516_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_cd7b1fc5b53b5b93c57ac130f1d5a516_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-19_cd7b1fc5b53b5b93c57ac130f1d5a516_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 70.6MB
- SHA256 02ecc1a27bf560ab4b0d9ad5702d9b4e0eac01caeeabf411e3cc2da1aa64b722
- MD5 cd7b1fc5b53b5b93c57ac130f1d5a516
- SHA1 701dedf3020f1ffb7f37b03895d4f7c66a48bdd6
- SHA512 e945c567f8ee286eb6c56585eca5e9031e05f400e2fbba53b15c6a3b40bbb9c1b70fc4a1ca8d50335c2a4699caaf71149c776e6f52228074e6f6b3c38c28b3f9
- SSDEEP 1572864:o9zXW5+dy2J0f0/rBdsG7bpip0WWinGCnk/+BDOyf/c9NCK+/eDKDe:o9T4I5BB7tE0WZGCnk/3NC8Do
- TLSH T138F73358A95506A7F68A8232D4E3E8967BBA35068FA6C0CE0BD54D034B771C9DC7CC73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.