2026-07-29_bf5dfabd005f0628b2ac45f21c8d5fab_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_bf5dfabd005f0628b2ac45f21c8d5fab_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 5.6MB
Sample260729-hc2fjsxbpg
SHA256 e235d1a93bd14e174d4a90a6c6d80ebf62128ea354a7ba7f085fe402bd46c392
MD5 bf5dfabd005f0628b2ac45f21c8d5fab
SHA1 88d8bf706df4e37235878080bd18d2f57876baf8
SHA512 ade4e3106597cc92608cbdc40f7216d43f21cd7d9530abb2787e828495dc0bc222e61174dc5fd2f524ec4fcb95993e58ab1336cd0a1e2eca28c8adc1da134e7f
SSDEEP 49152:l7VwASOzGtlqjQIU6iXYe2a8Nolm4yJBRuZ0y/54mSJbGGoUu8I3Mp5IyXE7hDgF:Xv+X9axuDxq7e3P8abnZ8i2aVhI
TLSH
T1A4569E66B2A900ECD47BD27CC6564523E3B2B81613719BCF06A5967A1F33AE15F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-29_bf5dfabd005f0628b2ac45f21c8d5fab_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 5.6MB

2026-07-29_bf5dfabd005f0628b2ac45f21c8d5fab_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 60cbdda2209263788d4ee89fd7695d0e
SHA256 e235d1a93bd14e174d4a90a6c6d80ebf62128ea354a7ba7f085fe402bd46c392
MD5 bf5dfabd005f0628b2ac45f21c8d5fab
SHA1 88d8bf706df4e37235878080bd18d2f57876baf8
SHA512 ade4e3106597cc92608cbdc40f7216d43f21cd7d9530abb2787e828495dc0bc222e61174dc5fd2f524ec4fcb95993e58ab1336cd0a1e2eca28c8adc1da134e7f
SSDEEP 49152:l7VwASOzGtlqjQIU6iXYe2a8Nolm4yJBRuZ0y/54mSJbGGoUu8I3Mp5IyXE7hDgF:Xv+X9axuDxq7e3P8abnZ8i2aVhI
TLSH
T1A4569E66B2A900ECD47BD27CC6564523E3B2B81613719BCF06A5967A1F33AE15F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

a2:ce:59:5b:ad:0c:01:20:6b:b0:e5:49:e6:fc:17:1e:50:63:7a:7d:b0:c0:34:de:d8:61:9e:10:4a:ee:85:a8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2025

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

a2:ce:59:5b:ad:0c:01:20:6b:b0:e5:49:e6:fc:17:1e:50:63:7a:7d:b0:c0:34:de:d8:61:9e:10:4a:ee:85:a8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=24741969,CN=I3D Technology Inc.,O=I3D Technology Inc.,ST=Taipei,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

Nov 12, 2025

SERIALNUMBER=24741969,CN=I3D Technology Inc.,O=I3D Technology Inc.,ST=Taipei,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=24741969,CN=I3D Technology Inc.,O=I3D Technology Inc.,ST=Taipei,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=24741969,CN=I3D Technology Inc.,O=I3D Technology Inc.,ST=Taipei,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Serial Number

8e:16:4d:af:c3:f8:f3:70:ec:5e:8d:77:d0:82:e3:95

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2025 - Aug 22, 2026

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:24:e7:6f:6c:a8:13:a2:7c:35:00:00:00:00:01:24

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 20, 2025 - Feb 18, 2026

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

2671776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

powrprof

PowerReadDCValueIndex PowerWriteDCValueIndex PowerWriteACValueIndex PowerGetActiveScheme PowerReadACValueIndex PowerSetActiveScheme CallNtPowerInformation

kernel32

SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetSystemTime GetDriveTypeW GetExitCodeProcess CreateMutexW ReleaseMutex SetThreadAffinityMask TryEnterCriticalSection SetHandleInformation EnterCriticalSection GetModuleHandleExW TerminateProcess SetThreadPriority LeaveCriticalSection InitializeCriticalSection SetFilePointer GetEnvironmentVariableW SetEndOfFile PeekNamedPipe GetLocaleInfoW GetCurrentThreadId UnmapViewOfFile GetModuleHandleA GetFileInformationByHandle FormatMessageW GetFileAttributesExW GetCurrentThread TerminateThread QueryPerformanceFrequency LoadLibraryW GetCurrentDirectoryW ReplaceFileW ExitProcess FreeLibrary CopyFileW QueryPerformanceCounter MoveFileW IsDebuggerPresent SetUnhandledExceptionFilter FlushFileBuffers OpenEventW SetThreadExecutionState SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetNativeSystemInfo DeleteFileW GetDiskFreeSpaceExW FileTimeToSystemTime GetPrivateProfileStringW SetFileAttributesW GetFileAttributesW FindClose RemoveDirectoryW ExpandEnvironmentStringsW FindNextFileW FindFirstFileW GetLogicalDrives GetVolumeInformationW GetSystemFirmwareTable Sleep GetLogicalDriveStringsW OpenProcess OutputDebugStringA Process32FirstW Process32NextW ProcessIdToSessionId CreateToolhelp32Snapshot GetModuleHandleW GetProcAddress LocalAlloc GetCurrentProcessId WTSGetActiveConsoleSessionId GetTimeZoneInformation CancelIo WaitForMultipleObjects WriteFile GetOverlappedResult ReadFile DisconnectNamedPipe ConnectNamedPipe CreateNamedPipeW lstrcatW WaitForSingleObjectEx CreateDirectoryW LocalFree OutputDebugStringW DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GetSystemWindowsDirectoryW GetSystemDirectoryA MultiByteToWideChar GetTempPathW GetModuleFileNameW HeapSize GetProcessHeap GetOEMCP IsValidCodePage HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA GetConsoleOutputCP SetStdHandle QueueUserWorkItem PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort SetErrorMode ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode RtlVirtualUnwind ConvertThreadToFiberEx FreeLibraryAndExitThread ExitThread LoadLibraryExW InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx RaiseException InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext GetCPInfo CompareStringEx SetEvent CreateThread CreateEventW GetSystemPowerStatus CloseHandle DeviceIoControl CreateFileW lstrcpyW GetLastError WaitForSingleObject lstrlenW lstrcmpiW LCMapStringEx EncodePointer SleepConditionVariableSRW GetStringTypeW FindFirstFileExW ConvertFiberToThread GetLocaleInfoEx GetStartupInfoW LoadLibraryExA ReadDirectoryChangesW GetLongPathNameW SetFilePointerEx GetFullPathNameW GetFileSizeEx LCMapStringW UnregisterWaitEx WriteConsoleInputW SetConsoleCursorPosition GetConsoleScreenBufferInfo WriteConsoleW ReadConsoleInputW GetNumberOfConsoleInputEvents GetNamedPipeHandleStateA CancelSynchronousIo SetNamedPipeHandleState CreateFileA DebugBreak SetConsoleCtrlHandler UnregisterWait RegisterWaitForSingleObject SwitchToThread CancelIoEx CreateSemaphoreA ReleaseSemaphore WakeAllConditionVariable TryAcquireSRWLockExclusive DuplicateHandle GetCurrentProcess IsWow64Process2 RtlUnwind GetEnvironmentVariableA GetSystemTimeAsFileTime ResetEvent CreateEventA WideCharToMultiByte SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo VirtualProtect VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetStdHandle GetFileType LoadLibraryA FormatMessageA GetACP

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetMessageA PostMessageW SendMessageTimeoutW DestroyWindow CreateWindowExW RegisterClassExW EnumWindows DispatchMessageA MapVirtualKeyW GetSystemMetrics wsprintfW UnregisterPowerSettingNotification RegisterPowerSettingNotification TranslateMessage GetWindowTextW AttachThreadInput DestroyIcon GetWindowThreadProcessId UnregisterClassW DefWindowProcW

advapi32

RegOpenKeyExW ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW DeleteService ControlService OpenServiceW RegCloseKey RegEnumKeyExW RegQueryValueExW SetTokenInformation ConvertStringSidToSidW CreateProcessAsUserW GetLengthSid DuplicateTokenEx SetSecurityDescriptorDacl InitializeSecurityDescriptor OpenProcessToken

shell32

SHQueryRecycleBinW SHEmptyRecycleBinW SHGetFolderPathW SHGetKnownFolderPath SHGetSpecialFolderPathW ExtractIconExW ExtractAssociatedIconExW

ole32

OleInitialize OleUninitialize CoInitializeSecurity CoCreateInstance CoTaskMemFree CoUninitialize CoSetProxyBlanket CoInitializeEx

oleaut32

SafeArrayUnaccessData SafeArrayAccessData SafeArrayPutElement VariantClear VariantInit SysFreeString SysAllocString SafeArrayCreate

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList CM_Get_Sibling CM_Get_Child SetupDiEnumDeviceInfo SetupDiGetDevicePropertyW SetupDiGetClassDevsW

shlwapi

PathAppendW PathFileExistsW PathRemoveFileSpecW

hid

HidD_SetFeature HidD_GetFeature HidD_FreePreparsedData HidD_GetHidGuid HidD_GetManufacturerString HidD_GetProductString HidP_GetButtonCaps HidP_GetCaps HidD_GetPreparsedData HidD_GetAttributes HidD_GetInputReport

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock GetProfilesDirectoryW

wininet

InternetSetFilePointer HttpQueryInfoW InternetOpenW HttpEndRequestW InternetWriteFile HttpOpenRequestW HttpSendRequestExW InternetCrackUrlW InternetReadFile InternetSetOptionW FtpOpenFileW InternetConnectW InternetCloseHandle

ws2_32

connect ntohs socket send inet_addr WSAStartup sendto listen select closesocket bind accept __WSAFDIsSet gethostbyname inet_ntoa gethostbyaddr getservbyport getservbyname WSASetLastError shutdown WSAIoctl WSASocketW WSARecv WSARecvFrom setsockopt WSAGetLastError ioctlsocket recv getsockopt htonl htons WSACleanup freeaddrinfo getaddrinfo

winmm

timeGetTime timeKillEvent timeBeginPeriod

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQuerySessionInformationW

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

177KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=206, id=261, version=33145,

count=21, id=259, version=33145,

count=6, id=253, version=33030,

count=19, id=260, version=33030,

count=18, id=259, version=33030,

count=111, id=261, version=33030,

count=35, id=260, version=31933,

count=1, id=261, version=32215,

count=6, id=260, version=32215,

count=783, id=260, version=31935,

count=33, productName=Unmarked objects (old),

count=1, id=260, version=32825,

count=1, id=261, version=32534,

count=50, id=260, version=33145,

count=2, id=262, version=33145,

count=1, id=263, version=33145,

count=41, id=257, version=33145,

count=529, id=1, productName=Unmarked objects,

count=60, id=265, version=33135,

count=1, id=255, version=33135,

count=1, id=151,

count=1, id=258, version=33135,