General
- Target 2026-07-28_9aff72c2a386602c663dcf194745aa21_blankgrabber_cobalt-strike_icedid_njrat_satacom
- Size 14.7MB
- Sample260728-y2hmqsvdqb
- SHA256 a9cdc1a8bb73ba7025351bc5fe4ed4002fcef991251eb902a494504597c65469
- MD5 9aff72c2a386602c663dcf194745aa21
- SHA1 58be92f27d979ce8c12340e50c35e35613a1fc29
- SHA512 efafc9fd627039d9b1a5153133c1de318c9ee257e9d9c9333fd46b80ca7150e3ebbc6ebace17c8b3f4a96a64ad703bec723f72fb57f58fe1bed53644349ead1a
- SSDEEP 393216:KqZaHmTZMvRFGAjM0L+b20g1zXHWgO/d5tH0OvoAWdW4vV:K/HBJFvMW+lg1zX2guNVWLV
- TLSH T16FF6331CE694C3F7C99F9B3A9D4149B5F627F85043126BDB09B5A2900E26EF01F387A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_9aff72c2a386602c663dcf194745aa21_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_9aff72c2a386602c663dcf194745aa21_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-28_9aff72c2a386602c663dcf194745aa21_blankgrabber_cobalt-strike_icedid_njrat_satacom
- Size 14.7MB
- SHA256 a9cdc1a8bb73ba7025351bc5fe4ed4002fcef991251eb902a494504597c65469
- MD5 9aff72c2a386602c663dcf194745aa21
- SHA1 58be92f27d979ce8c12340e50c35e35613a1fc29
- SHA512 efafc9fd627039d9b1a5153133c1de318c9ee257e9d9c9333fd46b80ca7150e3ebbc6ebace17c8b3f4a96a64ad703bec723f72fb57f58fe1bed53644349ead1a
- SSDEEP 393216:KqZaHmTZMvRFGAjM0L+b20g1zXHWgO/d5tH0OvoAWdW4vV:K/HBJFvMW+lg1zX2guNVWLV
- TLSH T16FF6331CE694C3F7C99F9B3A9D4149B5F627F85043126BDB09B5A2900E26EF01F387A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.