General
- Target 2026-08-06_f02c6c955e16c33e5e79b09f0e44f89f_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_smoke-loader_stealc_vidar_zxxz
- Size 137.3MB
- Sample260806-bej6qavyhy
- SHA256 b8563eef3789b599ca08e46dc47e1b2e6d6aeb463835aa6ca707f47b34d4f496
- MD5 f02c6c955e16c33e5e79b09f0e44f89f
- SHA1 9f78b9c3d7b6a8f8c077d8722cd330aa121dc185
- SHA512 47766e5e250b228ec55d92d7c129a402ea8c1ab20beedaa54329843bb4cc931aa8d37819a88c76962b9419284e19857bf1281c325fbb1593742180ad821e52f0
- SSDEEP 1572864:FBeI7yCDsW/oRHJWtrGRddjkWItP6HmukGTt3+elTzMg:FBeIZMHQrGRzkWItP6HmbGTt3+elTz3
- TLSH T1C268AE4277FA1563D1A39179879FA102E731F0071334CAC7366C83646F57AE0AEBAB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-06_f02c6c955e16c33e5e79b09f0e44f89f_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_f02c6c955e16c33e5e79b09f0e44f89f_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_ic.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-06_f02c6c955e16c33e5e79b09f0e44f89f_amadey_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_smoke-loader_stealc_vidar_zxxz
- Size 137.3MB
- SHA256 b8563eef3789b599ca08e46dc47e1b2e6d6aeb463835aa6ca707f47b34d4f496
- MD5 f02c6c955e16c33e5e79b09f0e44f89f
- SHA1 9f78b9c3d7b6a8f8c077d8722cd330aa121dc185
- SHA512 47766e5e250b228ec55d92d7c129a402ea8c1ab20beedaa54329843bb4cc931aa8d37819a88c76962b9419284e19857bf1281c325fbb1593742180ad821e52f0
- SSDEEP 1572864:FBeI7yCDsW/oRHJWtrGRddjkWItP6HmukGTt3+elTzMg:FBeIZMHQrGRzkWItP6HmbGTt3+elTz3
- TLSH T1C268AE4277FA1563D1A39179879FA102E731F0071334CAC7366C83646F57AE0AEBAB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.