General
- Target 2026-07-31_50e7dcc0200b1ac90394f9d83a65a3b5_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_pos_satacom_stealc_vidar
- Size 85.0MB
- Sample260731-e1c63sce99
- SHA256 14ab36417dad855d3fb70a90948ce5084e1002aa0ec1407cbbcce78b16d3c852
- MD5 50e7dcc0200b1ac90394f9d83a65a3b5
- SHA1 1ef413b0771bb6710715223e2e0ad420f0a18faa
- SHA512 bee3642236e9c45f2f36e58e68013922e459dde1e6f330fb49e5f03beb82490ce89e9163fafd7f48831fae740d964bdb79e66d9753fcc40693091b7f70c49ea5
- SSDEEP 786432:Rts3D1AWgNESvOefB/wLLWhA3IjYYFtuCfTgkqMvoWIPOSlAN:LsSNESvOwmLLWhKInThSl
- TLSH T148189D43B3954091D4B7D27C8D4B820BF7B2BC12171297CB2169AA5D2F737E22A7E748
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-31_50e7dcc0200b1ac90394f9d83a65a3b5_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_50e7dcc0200b1ac90394f9d83a65a3b5_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_pos_satacom_stealc_vidar
- Size 85.0MB
- SHA256 14ab36417dad855d3fb70a90948ce5084e1002aa0ec1407cbbcce78b16d3c852
- MD5 50e7dcc0200b1ac90394f9d83a65a3b5
- SHA1 1ef413b0771bb6710715223e2e0ad420f0a18faa
- SHA512 bee3642236e9c45f2f36e58e68013922e459dde1e6f330fb49e5f03beb82490ce89e9163fafd7f48831fae740d964bdb79e66d9753fcc40693091b7f70c49ea5
- SSDEEP 786432:Rts3D1AWgNESvOefB/wLLWhA3IjYYFtuCfTgkqMvoWIPOSlAN:LsSNESvOwmLLWhKInThSl
- TLSH T148189D43B3954091D4B7D27C8D4B820BF7B2BC12171297CB2169AA5D2F737E22A7E748
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates processes with tasklist