68e0bea84b77dbd9afe7c78176ba50012d69b0ea8db1fdfc01bfe066d930d2e0

General

Target
2026-08-04_02b42dd0e947ab96d8bfeb8f991cade5_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc
Size 8.2MB
Sample260805-brfdasvhng
SHA256 68e0bea84b77dbd9afe7c78176ba50012d69b0ea8db1fdfc01bfe066d930d2e0
MD5 02b42dd0e947ab96d8bfeb8f991cade5
SHA1 f2ae093de37107b6ca062158fa51372366a65dd2
SHA512 fe3484873124c2134fd8a9d8775de0ca79bba3d150b4f438c595cb02a34acdb9bf194801ffef78379ae07a4ba4bcdbde8c4fae976cecbcc296495c8cbc385cf3
SSDEEP 196608:+ud5HikxpnPIaJJ4KEuMtxFnqHOUgBRD:9d5HikxFPIaJynuaxFnqHOUY
TLSH
T1A686BFA9A6BC01D9E867C1BDC2965223EB72B41517B057CF1A609AF60F23BD01E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-04_02b42dd0e947ab96d8bfeb8f991cade5_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc
- Size 8.2MB
- SHA256 68e0bea84b77dbd9afe7c78176ba50012d69b0ea8db1fdfc01bfe066d930d2e0
- MD5 02b42dd0e947ab96d8bfeb8f991cade5
- SHA1 f2ae093de37107b6ca062158fa51372366a65dd2
- SHA512 fe3484873124c2134fd8a9d8775de0ca79bba3d150b4f438c595cb02a34acdb9bf194801ffef78379ae07a4ba4bcdbde8c4fae976cecbcc296495c8cbc385cf3
- SSDEEP 196608:+ud5HikxpnPIaJJ4KEuMtxFnqHOUgBRD:9d5HikxFPIaJynuaxFnqHOUY
- TLSH
  T1A686BFA9A6BC01D9E867C1BDC2965223EB72B41517B057CF1A609AF60F23BD01E7F740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence trojan
- Detects executables containing URLs to raw contents of a Github gist
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2