2026-07-27_712ba8c5edeb5f44b72891f11870e90b_blankgrabber_cobalt-strike_emotet_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_712ba8c5edeb5f44b72891f11870e90b_blankgrabber_cobalt-strike_emotet_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar_wannacry
Size 10.6MB
Sample260727-hfl52axtd1
SHA256 62cda4b9b52829d4f30e6bd0216b11b964b9b3657c13f85f936686c0490ad342
MD5 712ba8c5edeb5f44b72891f11870e90b
SHA1 5c44f547bfd022ac79f455ee93e563b356121a7f
SHA512 3a2089b9f750f344a856f34dddbecafba9426cdce4c2bfc61c51ea614494c5880f9adf7019033c638d09139b97d8f9a0b04e599876fceffb9f457b974cb0f00e
SSDEEP 196608:qyoHT/xFzAKXbeO7btUTGlG5ha3wfI9jSQflYZtPL8s7QoVy81z81y:ql7xUg0acIjM3VVmy
TLSH
T12FB6F142B594C1B2C2C58972DD56D5B3EB303DBD87F6067B32A8FED63A322903A25315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_712ba8c5edeb5f44b72891f11870e90b_blankgrabber_cobalt-strike_emotet_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar_wannacry

File Explorer

2026-07-27_712ba8c5edeb5f44b72891f11870e90b_blankgrabber_cobalt-strike_emotet_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar_wannacry

.exe 10.6MB
all.pyc

1KB

2026-07-27_712ba8c5edeb5f44b72891f11870e90b_blankgrabber_cobalt-strike_emotet_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar_wannacry

IMPHASH 5055c55065f131d774a6271d13d0de31
SHA256 62cda4b9b52829d4f30e6bd0216b11b964b9b3657c13f85f936686c0490ad342
MD5 712ba8c5edeb5f44b72891f11870e90b
SHA1 5c44f547bfd022ac79f455ee93e563b356121a7f
SHA512 3a2089b9f750f344a856f34dddbecafba9426cdce4c2bfc61c51ea614494c5880f9adf7019033c638d09139b97d8f9a0b04e599876fceffb9f457b974cb0f00e
SSDEEP 196608:qyoHT/xFzAKXbeO7btUTGlG5ha3wfI9jSQflYZtPL8s7QoVy81z81y:ql7xUg0acIjM3VVmy
TLSH
T12FB6F142B594C1B2C2C58972DD56D5B3EB303DBD87F6067B32A8FED63A322903A25315
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

502560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\DW ESP\x64\Release\春秋蝉.pdb

d3d11

D3D11CreateDeviceAndSwapChain

crypt32

CryptStringToBinaryA

kernel32

GetModuleHandleW CopyFileW GetTickCount OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW Module32FirstW Module32NextW GetCurrentProcess GetVolumeInformationA GetLocalTime GetProcAddress GetConsoleWindow AllocConsole IsDebuggerPresent MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter DeleteCriticalSection SetEndOfFile HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation SetFilePointerEx CreateProcessW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetFileType HeapAlloc HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetModuleHandleExW TerminateProcess ExitProcess IsProcessorFeaturePresent ReadFile FlsFree FlsSetValue FlsGetValue ReadProcessMemory LocalFree CloseHandle GetLastError GetTickCount64 Sleep GetCommandLineA CreateMutexW GetTempPathW GetProcessId GetModuleFileNameW InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo GetStringTypeW LCMapStringEx DecodePointer GetCommandLineW GetModuleFileNameA WriteConsoleW GetFileSizeEx RtlUnwind EncodePointer

user32

IsWindowUnicode UnregisterClassW CreateWindowExW keybd_event MessageBoxW SetWindowPos IsWindowVisible DestroyWindow GetWindowRect FindWindowExW SetForegroundWindow UpdateWindow PostQuitMessage GetClientRect SetWindowLongW mouse_event TranslateMessage SetLayeredWindowAttributes SetWindowDisplayAffinity PeekMessageW DispatchMessageW GetAsyncKeyState IsWindow ShowWindow DefWindowProcW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetWindowThreadProcessId ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SendInput RegisterClassExW

advapi32

CryptCreateHash CryptDestroyHash CryptHashData CryptAcquireContextW CryptGetHashParam CryptReleaseContext

shell32

CommandLineToArgvW ShellExecuteA

winmm

timeEndPeriod timeBeginPeriod

bcrypt

BCryptSetProperty BCryptDecrypt BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptCloseAlgorithmProvider

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

697KB

Virtual Size

697KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

177KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9.7MB

Virtual Size

9.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_712ba8c5edeb5f44b72891f11870e90b_blankgrabber_cobalt-strike_emotet_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar_wannacry

d3d11

crypt32

kernel32

user32

advapi32

shell32

winmm

bcrypt

winhttp

imm32

generic

all.pyc