2026-08-02_d52a018c9abad2dd8632ef637030a6d7_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

General

Target
2026-08-02_d52a018c9abad2dd8632ef637030a6d7_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 3.1MB
Sample260802-c17dtabq8w
SHA256 559e5627d94c0ee9def8ec85dd7ad8951c31993218f912bb0f9a7aaf6728e7de
MD5 d52a018c9abad2dd8632ef637030a6d7
SHA1 92d9c73f0078bc757162cdb0130823abf1447a5c
SHA512 cee2baf5e3397a2882faedf80d5e36412ff495b05a4c51fd51da81bc2c9d39f1e6a366fa7509d34a4054a9b7a54cb62e77a677bede662cb58b146a6c9212ab26
SSDEEP 49152:K0oMummHaYGSlKQqmcCUaI9t23DXnjHqwk2Z9yy3UNjuP3fWkV:ZfuMHQDI9sXnjHqwk2Z9yy3UNjW3fWk
TLSH
T1D6E56CC2BA911EE7FD66F2B9805E4310A724D27B23099153704CC36E3F4A3D45E76A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_d52a018c9abad2dd8632ef637030a6d7_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-08-02_d52a018c9abad2dd8632ef637030a6d7_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

.exe 3.1MB

2026-08-02_d52a018c9abad2dd8632ef637030a6d7_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 9612bf3b7d3015338f4adcaf9563c397
SHA256 559e5627d94c0ee9def8ec85dd7ad8951c31993218f912bb0f9a7aaf6728e7de
MD5 d52a018c9abad2dd8632ef637030a6d7
SHA1 92d9c73f0078bc757162cdb0130823abf1447a5c
SHA512 cee2baf5e3397a2882faedf80d5e36412ff495b05a4c51fd51da81bc2c9d39f1e6a366fa7509d34a4054a9b7a54cb62e77a677bede662cb58b146a6c9212ab26
SSDEEP 49152:K0oMummHaYGSlKQqmcCUaI9t23DXnjHqwk2Z9yy3UNjuP3fWkV:ZfuMHQDI9sXnjHqwk2Z9yy3UNjW3fWk
TLSH
T1D6E56CC2BA911EE7FD66F2B9805E4310A724D27B23099153704CC36E3F4A3D45E76A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

140936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

python39

_PyLong_New PyFloat_FromDouble PyComplex_FromDoubles PyList_Sort PyDict_GetItem PyDict_DelItem PyDict_MergeFromSeq2 PyDict_GetItemString PyDict_SetItemString _PyDict_NewPresized _PySet_NextEntry PySet_New PyFrozenSet_New PySet_Add PyCMethod_New PyModule_NewObject PyModule_GetDict PyModule_GetName PyModule_GetFilenameObject PyModule_GetDef PyCode_NewWithPosOnlyArgs PySlice_New PyErr_ExceptionMatches PyErr_BadArgument PyErr_NoMemory PyErr_WriteUnraisable PyOS_snprintf _PyErr_FormatFromCause PyArg_ParseTuple PyArg_ParseTupleAndKeywords PyArg_UnpackTuple _PyArg_NoKeywords PyModule_ExecDef PyModule_FromDefAndSpec2 Py_CompileStringExFlags PyErr_Print PyEval_GetFuncName PyEval_RestoreThread PySys_WriteStderr PyImport_ExecCodeModule PyImport_ExecCodeModuleEx PyImport_GetModuleDict PyImport_ImportModule PyImport_ImportFrozenModule _PyImport_FixupExtensionObject PyObject_Call PyObject_CallFunctionObjArgs PyObject_CallMethodObjArgs PyObject_SetItem PyObject_DelItem PyObject_GetIter PyIter_Next PyNumber_Add PyNumber_Subtract PyNumber_FloorDivide PyNumber_Negative PyNumber_InPlaceAdd PyNumber_InPlaceLshift PySequence_List PySequence_Contains PyObject_IsInstance PyObject_IsSubclass PyObject_LengthHint PyMarshal_ReadObjectFromString _PyErr_NormalizeException PyBaseObject_Type _Py_NotImplementedStruct PyByteArray_Type PyBytes_Type PyLong_Type PyBool_Type PyFloat_Type PyComplex_Type PyRange_Type PyTuple_Type PyList_Type PyDict_Type PySet_Type PyFrozenSet_Type PyCFunction_Type PyModule_Type PyModuleDef_Type PyFunction_Type PyMethod_Type PyCode_Type PyTraceBack_Type _Py_EllipsisObject PySlice_Type PyEllipsis_Type PyGen_Type PyCoro_Type PyAsyncGen_Type _PyAsyncGenWrappedValue_Type Py_GenericAliasType PyExc_StopAsyncIteration PyExc_GeneratorExit PyExc_AttributeError PyExc_ImportError PyExc_KeyError PyExc_NameError PyExc_OverflowError PyExc_RuntimeError PyExc_ValueError _Py_PackageContext PyFrame_Type PyLong_FromSsize_t _PyUnicode_Ready PyUnicode_New PyUnicode_Join PyUnicode_Concat PyUnicode_DecodeUTF8 PyUnicode_AsWideCharString PyUnicode_FromWideChar PyUnicode_InternInPlace PyUnicode_FromFormat PyUnicode_GetLength PyUnicode_Substring PyUnicode_FromStringAndSize PyBytes_AsString PyBytes_FromString PyBytes_FromStringAndSize PyByteArray_FromStringAndSize PyByteArray_FromObject PyObject_GC_Del _PyObject_GC_Resize _PyObject_New PyObject_Free PyObject_Realloc PyMem_GetAllocator _PyType_Lookup _Py_NewReference PyObject_ClearWeakRefs PyCallable_Check PyObject_GenericSetAttr PyObject_SelfIter PyObject_SetAttr PyObject_GetAttr PyObject_SetAttrString PyObject_GetAttrString PyObject_RichCompareBool PyObject_RichCompare PyObject_Str PyObject_Repr PyType_Ready PyType_GetFlags PyType_IsSubtype _Py_path_config PyImport_FrozenModules Py_UTF8Mode Py_NoUserSiteDirectory Py_DontWriteBytecodeFlag Py_IgnoreEnvironmentFlag Py_FrozenFlag Py_BytesWarningFlag Py_NoSiteFlag Py_OptimizeFlag Py_InspectFlag Py_InteractiveFlag Py_VerboseFlag Py_DebugFlag _PyConfig_InitCompatConfig _PyRuntime_Initialize PySys_SetArgv Py_ExitStatusException Py_InitializeFromConfig Py_SetProgramName Py_Exit PyErr_PrintEx PyErr_SetInterrupt _PyWarnings_Init PyConfig_SetArgv PyConfig_SetString PyWideStringList_Append PyStatus_Exception PyDict_DelItemString PyLong_AsLong PyUnicode_AsUTF8 _PyRuntime PyExc_TypeError PyExc_SystemExit PyExc_SystemError PyExc_StopIteration PySeqIter_Type PyUnicode_Type _Py_NoneStruct PyType_Type PySequence_Check PyNumber_AsSsize_t PyEval_AcquireThread PyEval_SaveThread Py_MakePendingCalls PyErr_Format Py_GenericAlias PyDict_SetItem PyDict_New PyList_New PyTuple_New _PyObject_GC_Malloc _Py_TrueStruct _Py_FalseStruct PySys_SetObject PySys_GetObject PyStructSequence_New PyStructSequence_InitType PyCapsule_New PyUnicode_FromString

kernel32

WriteConsoleW HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose MultiByteToWideChar GetFileType LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetStdHandle SetConsoleCtrlHandler GetCommandLineW GetCommandLineA GetModuleHandleExW RtlPcToFileHeader RaiseException EncodePointer FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError RtlUnwindEx GetEnvironmentVariableA GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentThreadId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WideCharToMultiByte FindResourceA FormatMessageA LockResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleA GetModuleFileNameW GetSystemTimeAsFileTime GetCurrentProcessId SetErrorMode WriteFile GetShortPathNameW CreateFileW SetEnvironmentVariableW GetEnvironmentVariableW SetDllDirectoryW OpenProcess CreateThread ExitProcess Sleep WaitForSingleObject GetLastError CloseHandle SetStdHandle

Name

.text

Size

244KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_d52a018c9abad2dd8632ef637030a6d7_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

python39

kernel32

generic