53bb04c42a63df39fe70b8b2b3a9c5d3670eeb624acf02cf7c712801c7ee9e79

General

Target
2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 50.0MB
Sample260802-db6awscj5x
SHA256 53bb04c42a63df39fe70b8b2b3a9c5d3670eeb624acf02cf7c712801c7ee9e79
MD5 958a96524fedb17b35a83665a62bf69c
SHA1 feb00c8a7cca4c3125f59f306c5a64e6c4d64eea
SHA512 895c17a9143a7f360de2d225f0a87911b732b0415968eca2f33e63eea4f52ba122e12fa63074e463dd26ccada25c42e2f8b5f6415314e3104e1982780afb5825
SSDEEP 1572864:NKXz8jSgWFHjzbWm6/UC8GcieH9Qh5CQ85:cXwl6HjzbWBT8GDeH9C5Cf5
TLSH
T1CCB73399339404D7F8CAC33EA1EBE47344C2FA291756C18B82B0656315632D5FEBAF25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-08-02_958a96524fedb17b35a83665a62bf69c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 50.0MB
- SHA256 53bb04c42a63df39fe70b8b2b3a9c5d3670eeb624acf02cf7c712801c7ee9e79
- MD5 958a96524fedb17b35a83665a62bf69c
- SHA1 feb00c8a7cca4c3125f59f306c5a64e6c4d64eea
- SHA512 895c17a9143a7f360de2d225f0a87911b732b0415968eca2f33e63eea4f52ba122e12fa63074e463dd26ccada25c42e2f8b5f6415314e3104e1982780afb5825
- SSDEEP 1572864:NKXz8jSgWFHjzbWm6/UC8GcieH9Qh5CQ85:cXwl6HjzbWBT8GDeH9C5Cf5
- TLSH
  T1CCB73399339404D7F8CAC33EA1EBE47344C2FA291756C18B82B0656315632D5FEBAF25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection defense_evasion discovery execution exploit persistence privilege_escalation
- Adds policy Run key to start application
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information as a root user.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2