blankgrabber | 828dd7b6f79eeea7c3c47951f44f23591108d3434b400be1224597c06ef096b8

General

Target
2026-08-02_dc7bae411d0ad6b6fd5866a9eecf8b27_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 10.9MB
Sample260802-zzlr2s1hnc
SHA256 828dd7b6f79eeea7c3c47951f44f23591108d3434b400be1224597c06ef096b8
MD5 dc7bae411d0ad6b6fd5866a9eecf8b27
SHA1 3d7b894def060d75596b387c463f97be84bc91b7
SHA512 d1263936d0b786f3da33c9a284641dcfa6dd93df395fd40b0f0c774c6d778898884f8201e91e1803a8415561f6da7fc9ca5b8688828c8e46193ea197240b44e7
SSDEEP 196608:5AxxkCKNFr48OuHsntMNkIahjyRumK4K1S0Dgp3AtRgEvoK7LVFLpSN3Hh:o2CK73p5Qms1SgtRLvF7XLpQh
TLSH
T1C4B6331477C54562EEE7513E4E62C60AFBE034568B60D6DF032897A43F2F8A1893E376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-02_dc7bae411d0ad6b6fd5866a9eecf8b27_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 10.9MB
- SHA256 828dd7b6f79eeea7c3c47951f44f23591108d3434b400be1224597c06ef096b8
- MD5 dc7bae411d0ad6b6fd5866a9eecf8b27
- SHA1 3d7b894def060d75596b387c463f97be84bc91b7
- SHA512 d1263936d0b786f3da33c9a284641dcfa6dd93df395fd40b0f0c774c6d778898884f8201e91e1803a8415561f6da7fc9ca5b8688828c8e46193ea197240b44e7
- SSDEEP 196608:5AxxkCKNFr48OuHsntMNkIahjyRumK4K1S0Dgp3AtRgEvoK7LVFLpSN3Hh:o2CK73p5Qms1SgtRLvF7XLpQh
- TLSH
  T1C4B6331477C54562EEE7513E4E62C60AFBE034568B60D6DF032897A43F2F8A1893E376
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution upx collection persistence privilege_escalation spyware stealer
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2