53098b99170ed17a29ba7e243273eb41ecc71da2012859d9a00a9795d048414e

General

Target
2026-08-05_be4681f2204dd13a85b76ea7f27fad43_blankgrabber_cobalt-strike_icedid_njrat_satacom
Size 50.8MB
Sample260805-y9eaaa1tdx
SHA256 53098b99170ed17a29ba7e243273eb41ecc71da2012859d9a00a9795d048414e
MD5 be4681f2204dd13a85b76ea7f27fad43
SHA1 4b1d5eba10126156847aa6ff8f429c1e7797d7b8
SHA512 0764783b9c47440bf8eadf20f913a8e51d6f8b91918a1db8f7540ced179187f5abb8cce6edcdfa06221065c4a711a313cbdcae499fda5493913476a202e1d4f4
SSDEEP 1572864:3MWqw42ZxZ8rtnkD2Wh/49YEtdFqeTIX2:iwYoB4GEzFqeTIX2
TLSH
T199C7330E77C09D96EEA3A4B5DAE22704967179007BC381D38288ECDEAD6FED04C75395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution

Malware Config

Targets

- Target
  2026-08-05_be4681f2204dd13a85b76ea7f27fad43_blankgrabber_cobalt-strike_icedid_njrat_satacom
- Size 50.8MB
- SHA256 53098b99170ed17a29ba7e243273eb41ecc71da2012859d9a00a9795d048414e
- MD5 be4681f2204dd13a85b76ea7f27fad43
- SHA1 4b1d5eba10126156847aa6ff8f429c1e7797d7b8
- SHA512 0764783b9c47440bf8eadf20f913a8e51d6f8b91918a1db8f7540ced179187f5abb8cce6edcdfa06221065c4a711a313cbdcae499fda5493913476a202e1d4f4
- SSDEEP 1572864:3MWqw42ZxZ8rtnkD2Wh/49YEtdFqeTIX2:iwYoB4GEzFqeTIX2
- TLSH
  T199C7330E77C09D96EEA3A4B5DAE22704967179007BC381D38288ECDEAD6FED04C75395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion execution
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for Parallels drivers on disk.
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VirtualBox drivers on disk
  defense_evasion
- Looks for VirtualBox executables on disk
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Loads dropped DLL
behavioral1 behavioral2