2026-07-31_cb2660cd9b79ed90c3f682d2e6fd7d95_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_cb2660cd9b79ed90c3f682d2e6fd7d95_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 6.9MB
Sample260731-t76vasbr8x
SHA256 a34f757d8a1fbce10357eb860b3173d73d6312044b0a7ad9e5fa28784bd2017f
MD5 cb2660cd9b79ed90c3f682d2e6fd7d95
SHA1 84c66f603b8fb83cf0d8ee690da702c2c6344b5a
SHA512 e412c7d9d8e39eec36941e8618a0e8687f840cb4c302dc3e8649cbe77e8a83e0bc36df8efdbeaeb7b433370f070be4142f52f37a268c3f2d10c5ebeeffeea53d
SSDEEP 98304:trvK7Uq0lY/bZIUj0a/9ofC3QU7FxzB2QoeN4j:JvKADsWZa/9ofC3QU7FxF2U4
TLSH
T1A9769E1E7A6D01E9C1BFE1788A87950BEBB17851033693DB66E18E550F13AF49E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_cb2660cd9b79ed90c3f682d2e6fd7d95_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-31_cb2660cd9b79ed90c3f682d2e6fd7d95_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 6.9MB

2026-07-31_cb2660cd9b79ed90c3f682d2e6fd7d95_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 355a84e97f35695474b733a1fa86c52a
SHA256 a34f757d8a1fbce10357eb860b3173d73d6312044b0a7ad9e5fa28784bd2017f
MD5 cb2660cd9b79ed90c3f682d2e6fd7d95
SHA1 84c66f603b8fb83cf0d8ee690da702c2c6344b5a
SHA512 e412c7d9d8e39eec36941e8618a0e8687f840cb4c302dc3e8649cbe77e8a83e0bc36df8efdbeaeb7b433370f070be4142f52f37a268c3f2d10c5ebeeffeea53d
SSDEEP 98304:trvK7Uq0lY/bZIUj0a/9ofC3QU7FxzB2QoeN4j:JvKADsWZa/9ofC3QU7FxF2U4
TLSH
T1A9769E1E7A6D01E9C1BFE1788A87950BEBB17851033693DB66E18E550F13AF49E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1914608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\46b11e3b0e9c76c4\BUILDS\Release\x64\AvBugReport.pdb

winhttp

WinHttpSetCredentials WinHttpSendRequest WinHttpWriteData WinHttpQueryOption WinHttpAddRequestHeaders WinHttpSetStatusCallback WinHttpCloseHandle WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpOpenRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen WinHttpSetOption

bcrypt

BCryptFinalizeKeyPair BCryptGenerateKeyPair BCryptDeriveKey BCryptSetProperty BCryptExportKey BCryptDestroySecret BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptEncrypt BCryptGenRandom BCryptSecretAgreement BCryptImportKeyPair

rpcrt4

NdrClientCall3 RpcBindingFree RpcStringFreeW RpcBindingFromStringBindingW RpcStringBindingComposeW UuidCreate RpcAsyncCompleteCall RpcStringBindingParseW NdrAsyncServerCall RpcAsyncInitializeHandle RpcEpUnregister Ndr64AsyncServerCallAll RpcServerUseProtseqEpW RpcObjectSetType RpcServerRegisterIf2 RpcServerUnregisterIfEx RpcImpersonateClient RpcRevertToSelf I_RpcBindingInqLocalClientPID RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin RpcIfInqId RpcMgmtEpEltInqDone UuidToStringW UuidFromStringW RpcAsyncCancelCall Ndr64AsyncClientCall NdrServerCallAll NdrServerCall2 RpcEpRegisterW RpcBindingToStringBindingW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken WTSQuerySessionInformationW

shell32

SHGetKnownFolderPath ord165

ntdll

NtSystemDebugControl RtlLookupFunctionEntry RtlVirtualUnwind NtClose NtCreateWorkerFactory NtQueryInformationProcess NtQuerySystemInformation NtQueryInformationWorkerFactory RtlNtStatusToDosError VerSetConditionMask NtOpenKey NtQueryKey NtDeleteKey RtlCaptureContext RtlDllShutdownInProgress NtSetInformationThread RtlPcToFileHeader RtlUnwindEx RtlUnwind

kernel32

Process32NextW GetProcessHandleCount CreateIoCompletionPort DeviceIoControl ReadProcessMemory TerminateProcess TlsFree TlsAlloc TlsSetValue TlsGetValue SetLastError GetNativeSystemInfo DuplicateHandle GetSystemTimes GetProcessTimes GetFileTime ExpandEnvironmentStringsA GetVersionExW LoadLibraryExW GetOverlappedResult PostQueuedCompletionStatus GetQueuedCompletionStatus WriteFile ReadFile CancelIoEx WaitForMultipleObjects GetTickCount64 VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileA CreateFileMappingW MapViewOfFile LockFileEx InitializeCriticalSectionEx HeapSize HeapReAlloc DecodePointer HeapDestroy CompareFileTime SetFilePointerEx UnlockFileEx GetFileSizeEx QueryUnbiasedInterruptTime UnregisterWaitEx ReadDirectoryChangesW ProcessIdToSessionId GetFileAttributesExW GetLocaleInfoW ResumeThread ResetEvent GetCurrentThread LocalFree TerminateThread SetThreadPriority InitializeCriticalSectionAndSpinCount QueryThreadCycleTime GetCurrentDirectoryW FindNextFileW WTSGetActiveConsoleSessionId DeleteProcThreadAttributeList K32GetProcessImageFileNameW GetThreadId CreatePipe SetHandleInformation LocalAlloc FlushFileBuffers GetFileInformationByHandle GetFullPathNameW OutputDebugStringA FileTimeToSystemTime GetModuleFileNameW FindClose GetSystemInfo ExpandEnvironmentStringsW GetShortPathNameW GetSystemWindowsDirectoryW GetProcessAffinityMask GetLongPathNameW GlobalMemoryStatusEx GetDateFormatW GetTimeFormatW GetExitCodeThread GetDriveTypeW SetFilePointer SetFileAttributesW GetFileSize SetEndOfFile MoveFileExW GetWindowsDirectoryW CreateDirectoryW FindFirstFileExW QueryDosDeviceW GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetVersion SizeofResource LockResource LoadResource FindResourceExW FindResourceW Process32FirstW CopyFileW SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolWait WaitForThreadpoolWaitCallbacks SystemTimeToFileTime GetSystemTime GetCommandLineA GetStdHandle GetConsoleOutputCP ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList GetStartupInfoW UnhandledExceptionFilter InitializeSListHead GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetSystemTimeAsFileTime UpdateProcThreadAttribute InitializeProcThreadAttributeList DeleteFileW CreateFileW FindFirstFileW VerifyVersionInfoW GetExitCodeProcess CreateProcessW GetFileAttributesW FreeLibrary LoadLibraryW GetSystemDirectoryW DeleteCriticalSection InitializeCriticalSection CreateThread WakeConditionVariable SetEnvironmentVariableW GetEnvironmentVariableW GetCurrentProcess GetProcessId GetCurrentProcessId DebugBreak FormatMessageW GetCurrentThreadId GetModuleHandleExW GetModuleFileNameA GlobalFree GetProcessHeap HeapAlloc HeapFree EnterCriticalSection LeaveCriticalSection CompareStringW SetErrorMode MultiByteToWideChar SetDllDirectoryW GetConsoleWindow CloseHandle ReleaseMutex WaitForSingleObject GetLastError CreateMutexW GetModuleHandleW GetProcAddress WideCharToMultiByte GetCommandLineW ExitProcess SetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CreateToolhelp32Snapshot K32GetProcessMemoryInfo IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation HeapQueryInformation WriteConsoleW RegisterWaitForSingleObject GetThreadTimes OpenProcess K32EnumProcesses IsProcessorFeaturePresent CloseThreadpoolWork SetFileCompletionNotificationModes GetQueuedCompletionStatusEx SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared SleepConditionVariableSRW WakeAllConditionVariable GetLocaleInfoEx WaitForSingleObjectEx GetFileInformationByHandleEx AreFileApisANSI GetStringTypeW InitOnceComplete InitOnceBeginInitialize FormatMessageA GetEnvironmentVariableA InitializeConditionVariable GetThreadPriority OpenThread GetPriorityClass QueryFullProcessImageNameW UnregisterWait CreateEventW GetTickCount VirtualQuery RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter RaiseException FlushInstructionCache VirtualProtect CheckRemoteDebuggerPresent SetEvent Sleep IsDebuggerPresent OutputDebugStringW GetSystemDirectoryA GetModuleHandleA LoadLibraryA SleepEx MoveFileExA

user32

PostMessageW RegisterClassExW GetClassInfoExW EnumWindows GetWindowThreadProcessId SetWindowLongPtrW SendMessageW RegisterWindowMessageW LoadStringW GetSystemMetrics GetGUIThreadInfo SendMessageCallbackW IsHungAppWindow PeekMessageW ShowWindow WaitForInputIdle

advapi32

OpenProcessToken SetSecurityDescriptorDacl RevertToSelf RegCloseKey CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus EventWriteTransfer EventRegister EventUnregister RegCreateKeyExW RegQueryValueExW OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation EqualSid ImpersonateLoggedOnUser ImpersonateSelf CryptReleaseContext CryptGenRandom CryptAcquireContextW RegDeleteTreeW RegDeleteKeyExW RegNotifyChangeKeyValue RegQueryMultipleValuesW RegQueryInfoKeyW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegSetValueExW RegEnumKeyExA RegQueryValueExA RegOpenKeyExA CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptAcquireContextA SystemFunction036 EnumServicesStatusW QueryServiceStatusEx QueryServiceConfigW FreeSid RegOpenKeyExW AddAce InitializeAcl GetLengthSid AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueW CheckTokenMembership DuplicateToken LookupAccountSidW DuplicateTokenEx InitializeSecurityDescriptor

ole32

CoInitializeEx CoCreateInstance CoUninitialize CoCreateGuid CLSIDFromString CoTaskMemFree StringFromGUID2

powrprof

CallNtPowerInformation

shlwapi

PathMatchSpecW PathAppendW

fltlib

FilterConnectCommunicationPort FilterLoad FilterGetMessage FilterReplyMessage FilterSendMessage

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertFreeCTLContext CertFreeCertificateChain CertFreeCRLContext CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertAddCertificateContextToStore CertFreeCertificateContext

oleaut32

VariantClear SysFreeString VariantInit

iphlpapi

CancelMibChangeNotify2 if_indextoname FreeMibTable GetBestRoute2 if_nametoindex GetAdaptersAddresses Icmp6SendEcho2 GetUnicastIpAddressTable Icmp6CreateFile IcmpSendEcho IcmpCreateFile IcmpCloseHandle GetNetworkParams

ws2_32

WSAWaitForMultipleEvents FreeAddrInfoExW WSACleanup getservbyname WSAResetEvent gethostname WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getsockopt WSAAddressToStringW ntohl WSASetLastError GetAddrInfoW FreeAddrInfoW ntohs getsockname bind htonl recvfrom select sendto connect htons WSAGetLastError ioctlsocket __WSAFDIsSet WSAIoctl setsockopt socket WSAStartup recv closesocket send GetAddrInfoExW

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

502KB

Virtual Size

542KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

213KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

600KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=223, id=261, version=33138,

count=12, id=259, version=33138,

count=8, id=253, version=34321,

count=19, id=260, version=34321,

count=12, id=259, version=34321,

count=122, id=261, version=34321,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=20, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=179, id=260, version=30154,

count=7, id=260, version=32545,

count=13, productName=Unmarked objects (old),

count=45, id=261, version=32545,

count=9, id=261, version=33520,

count=41, id=260, version=33138,

count=43, id=257, version=33138,

count=662, id=1, productName=Unmarked objects,

count=428, id=265, version=34436,

count=1, id=256, version=34436,

count=1, id=255, version=34436,

count=2, id=151,

count=1, id=258, version=34436,