General
- Target 2026-08-04_63a058c48ff36b25f8cf6456ce5be497_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 7.4MB
- Sample260804-ht5jjayvdy
- SHA256 3c9def842e11bab25d3778871146efdbd0988cf5f4aeb65d75190289e7e570fd
- MD5 63a058c48ff36b25f8cf6456ce5be497
- SHA1 5e99fc9e11165f02e82277dfa3744465de880616
- SHA512 cab640a9fc111399abdef1656f8a6638c1b7344f671b71203ac5bcf0620ee07db6ba4996373f6cfc46fbf8ebbf9a316e386469b1ef85a830e638464343457940
- SSDEEP 98304:4+q6pQE5qQhw2AHVPVKKcnBdw+gpiMQwySjcTcuslgJTIZ5Bgp:4pYl9hw2AHVPVKKcQngwljIsT6p
- TLSH T10E76C069A6BC00E9E466C1BCC2875223EB72B91517B117CF5A649AF60F23AD01F7F740
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_63a058c48ff36b25f8cf6456ce5be497_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
Resource
win10v2004-20260513-en
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_63a058c48ff36b25f8cf6456ce5be497_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
Resource
win11ltsc2024-20260709-en
20 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_63a058c48ff36b25f8cf6456ce5be497_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 7.4MB
- SHA256 3c9def842e11bab25d3778871146efdbd0988cf5f4aeb65d75190289e7e570fd
- MD5 63a058c48ff36b25f8cf6456ce5be497
- SHA1 5e99fc9e11165f02e82277dfa3744465de880616
- SHA512 cab640a9fc111399abdef1656f8a6638c1b7344f671b71203ac5bcf0620ee07db6ba4996373f6cfc46fbf8ebbf9a316e386469b1ef85a830e638464343457940
- SSDEEP 98304:4+q6pQE5qQhw2AHVPVKKcnBdw+gpiMQwySjcTcuslgJTIZ5Bgp:4pYl9hw2AHVPVKKcQngwljIsT6p
- TLSH T10E76C069A6BC00E9E466C1BCC2875223EB72B91517B117CF5A649AF60F23AD01F7F740
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1