2026-08-06_4cac35460a97c267a40118bb2c2ffb7f_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

General

Target
2026-08-06_4cac35460a97c267a40118bb2c2ffb7f_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar
Size 61.7MB
Sample260807-a6cehsdn5w
SHA256 d128dc9c87b807fb26c1f1a0e400eddae10b8b1f7b34216d5307634ad405b87d
MD5 4cac35460a97c267a40118bb2c2ffb7f
SHA1 04b2e1422ca7e936c95055bba8b797bc8f704a1d
SHA512 de01ae741222789faf19c24b82ac025e5a3cee560c8417dc08041d08d3118b5e2b72e2cd443bdec8ecc14c538ad41ca7557f7105cc3f7a9d473ae8b9ef43466e
SSDEEP 393216:ceBvTPJOm1kQ2DS71T2KE6UhzG+u6fb+SJ8aqq1CPwDvt3uFhCdFe9XbQUveqpqK:ceyOkZDS7d2L9j1cz
TLSH
T120E77C5233600046EBB6C0758D369B13EFB2BC9A136416C735D8E6A92F77ED12AFD184
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_4cac35460a97c267a40118bb2c2ffb7f_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

File Explorer

2026-08-06_4cac35460a97c267a40118bb2c2ffb7f_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

.exe 61.7MB

2026-08-06_4cac35460a97c267a40118bb2c2ffb7f_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

IMPHASH 690dba2e531804cf853d5d15de87e463
SHA256 d128dc9c87b807fb26c1f1a0e400eddae10b8b1f7b34216d5307634ad405b87d
MD5 4cac35460a97c267a40118bb2c2ffb7f
SHA1 04b2e1422ca7e936c95055bba8b797bc8f704a1d
SHA512 de01ae741222789faf19c24b82ac025e5a3cee560c8417dc08041d08d3118b5e2b72e2cd443bdec8ecc14c538ad41ca7557f7105cc3f7a9d473ae8b9ef43466e
SSDEEP 393216:ceBvTPJOm1kQ2DS71T2KE6UhzG+u6fb+SJ8aqq1CPwDvt3uFhCdFe9XbQUveqpqK:ceyOkZDS7d2L9j1cz
TLSH
T120E77C5233600046EBB6C0758D369B13EFB2BC9A136416C735D8E6A92F77ED12AFD184
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHFileOperationW SHGetFolderPathW CommandLineToArgvW

kernel32

FlsSetValue WriteConsoleW HeapReAlloc CreateDirectoryW SetConsoleCtrlHandler AddDllDirectory GetCommandLineW GetFullPathNameW GetStdHandle WriteFile GetShortPathNameW TerminateProcess GetModuleFileNameW SetEnvironmentVariableW K32GetModuleFileNameExW GetEnvironmentVariableW GetTempPathW WaitForSingleObject CreateFileW GetFileAttributesW GetModuleHandleA OpenProcess Sleep GetLastError CloseHandle GetProcAddress GetCurrentProcessId CreateProcessW WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA QueryPerformanceCounter SetDllDirectoryW LoadLibraryExW GetExitCodeProcess GetCurrentThreadId InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW HeapSize RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent GetCommandLineA RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter MultiByteToWideChar HeapAlloc HeapFree VirtualProtect CompareStringW LCMapStringW GetFileType GetStringTypeW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx

Name

.text

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61.6MB

Virtual Size

61.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_4cac35460a97c267a40118bb2c2ffb7f_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

shell32

kernel32

generic