fdec2e5979d1f067c98807be3183c280d866d1642caaabe94c07d191bdb25c25

General

Target
2026-08-04_796752ced595f4769921a3e8a7fd0da4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 8.6MB
Sample260804-hhdxfaysds
SHA256 fdec2e5979d1f067c98807be3183c280d866d1642caaabe94c07d191bdb25c25
MD5 796752ced595f4769921a3e8a7fd0da4
SHA1 9236370b2adb16af13735c04ad6690a97868452b
SHA512 1258b3cc8f380f9f5335059f77007a37bd429249f9e5a18e77eef8e3c93575603f5a375e3a775981761eea68f43aaa162209c283eeadb8dececec685e0444218
SSDEEP 196608:+G2emN4vVZurHm/uhHToAUPNfGU5vXvWiu4aLSdIEMZ+:+t0uCmhHTodRGkXeVuOA
TLSH
T19F96336AA2D54EF8FEA7B23C45534250A7B27C121731C5DB03E88A623E375F43935B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-08-04_796752ced595f4769921a3e8a7fd0da4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 8.6MB
- SHA256 fdec2e5979d1f067c98807be3183c280d866d1642caaabe94c07d191bdb25c25
- MD5 796752ced595f4769921a3e8a7fd0da4
- SHA1 9236370b2adb16af13735c04ad6690a97868452b
- SHA512 1258b3cc8f380f9f5335059f77007a37bd429249f9e5a18e77eef8e3c93575603f5a375e3a775981761eea68f43aaa162209c283eeadb8dececec685e0444218
- SSDEEP 196608:+G2emN4vVZurHm/uhHToAUPNfGU5vXvWiu4aLSdIEMZ+:+t0uCmhHTodRGkXeVuOA
- TLSH
  T19F96336AA2D54EF8FEA7B23C45534250A7B27C121731C5DB03E88A623E375F43935B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access defense_evasion discovery execution spyware stealer persistence privilege_escalation
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2