2026-07-31_4a68f9532c5fadfd6b90b9c2f49ffc83_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_4a68f9532c5fadfd6b90b9c2f49ffc83_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc
Size 7.2MB
Sample260731-e1g52awscv
SHA256 5b298bb0e3273b7b6c6a4990ed48fbeddc95d5062a2cc4cc5a2d7327c0a14828
MD5 4a68f9532c5fadfd6b90b9c2f49ffc83
SHA1 d751c47f8bfe53b6940b22de2893ddb92b0d88f6
SHA512 9a85be780b4ae2f1f57520cb30638f6c28bedcbf76fbf763d26de7508c13206474231601b54ed29cb8c2f40ea0c0f5446c156f792c862044e5a334f2f1ca82ba
SSDEEP 98304:bjPIEOCTnPQ4Uj+PRFRF1MAOFHJod69oiYSn7rzd1s:b4uPXUAb1Nmboy7X
TLSH
T1B576F12BB16401DCD0A7C0B899AB6657E6303C58077056DB13C59A1A2F77EE02F7FB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with Enigma 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Enigma

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_4a68f9532c5fadfd6b90b9c2f49ffc83_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-31_4a68f9532c5fadfd6b90b9c2f49ffc83_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc

.exe 7.2MB

2026-07-31_4a68f9532c5fadfd6b90b9c2f49ffc83_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc

SHA256 5b298bb0e3273b7b6c6a4990ed48fbeddc95d5062a2cc4cc5a2d7327c0a14828
MD5 4a68f9532c5fadfd6b90b9c2f49ffc83
SHA1 d751c47f8bfe53b6940b22de2893ddb92b0d88f6
SHA512 9a85be780b4ae2f1f57520cb30638f6c28bedcbf76fbf763d26de7508c13206474231601b54ed29cb8c2f40ea0c0f5446c156f792c862044e5a334f2f1ca82ba
SSDEEP 98304:bjPIEOCTnPQ4Uj+PRFRF1MAOFHJod69oiYSn7rzd1s:b4uPXUAb1Nmboy7X
TLSH
T1B576F12BB16401DCD0A7C0B899AB6657E6303C58077056DB13C59A1A2F77EE02F7FB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with Enigma
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1447232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

680KB

Virtual Size

680KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.enigma1

Size

3.7MB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma2

Size

804KB

Virtual Size

804KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_4a68f9532c5fadfd6b90b9c2f49ffc83_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc

generic