2026-08-08_0de05f7e8beb6351e088c7af3b8a29cf_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_0de05f7e8beb6351e088c7af3b8a29cf_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 1.9MB
Sample260808-eqhzksbf73
SHA256 a3a230bafebbb687befee68eb44f6004c6df4b102855dac12ddd191ceb19d9ba
MD5 0de05f7e8beb6351e088c7af3b8a29cf
SHA1 48ca267a935612c4b87865e915f289f96f19c299
SHA512 4280cbab0c1d2dd0659b90ca0c44aa15cd16985a2d8366a09e17530e3c4c2220f9745eed06a901e4119bcc9fa48e7f1421282eb02d6424eb4b4280892284e0b1
SSDEEP 49152:5hcsPpI678kqSPfolb1KsOMP5nahUNk9tBACNnZhI:5RIuIJ1KsOMP5nahri
TLSH
T178956C1FB67504A8D066817489458A07E7B1BC0A1B749BCF87D06A6A6F33AD13F7B370
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_0de05f7e8beb6351e088c7af3b8a29cf_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-08-08_0de05f7e8beb6351e088c7af3b8a29cf_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 1.9MB

2026-08-08_0de05f7e8beb6351e088c7af3b8a29cf_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 6c18ad4d50329876d5a25e85399d1bd1
SHA256 a3a230bafebbb687befee68eb44f6004c6df4b102855dac12ddd191ceb19d9ba
MD5 0de05f7e8beb6351e088c7af3b8a29cf
SHA1 48ca267a935612c4b87865e915f289f96f19c299
SHA512 4280cbab0c1d2dd0659b90ca0c44aa15cd16985a2d8366a09e17530e3c4c2220f9745eed06a901e4119bcc9fa48e7f1421282eb02d6424eb4b4280892284e0b1
SSDEEP 49152:5hcsPpI678kqSPfolb1KsOMP5nahUNk9tBACNnZhI:5RIuIJ1KsOMP5nahri
TLSH
T178956C1FB67504A8D066817489458A07E7B1BC0A1B749BCF87D06A6A6F33AD13F7B370
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

969616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SLOWLauncher.pdb

ws2_32

WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect send __WSAFDIsSet WSAResetEvent WSAWaitForMultipleEvents WSAGetLastError closesocket htons socket ntohs WSAStartup gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl select getsockopt WSAIoctl WSASetLastError setsockopt recv getsockname getpeername connect bind accept WSACleanup

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertGetNameStringW CertCloseStore CertOpenStore CryptStringToBinaryW PFXImportCertStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertFreeCertificateContext CertFindExtension CertFreeCTLContext CertAddCertificateContextToStore CertFreeCRLContext CryptDecodeObjectEx

iphlpapi

if_nametoindex

secur32

InitSecurityInterfaceW

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoInitializeSecurity CoInitializeEx CoUninitialize CoSetProxyBlanket CoCreateInstance

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

kernel32

CompareStringW LCMapStringW GetLocaleInfoW GetTimeFormatW GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetDateFormatW IsValidLocale GetModuleHandleExW FreeLibraryAndExitThread HeapAlloc UnhandledExceptionFilter HeapReAlloc SetStdHandle RtlVirtualUnwind RtlCaptureContext GetModuleFileNameW TerminateProcess IsProcessorFeaturePresent ExitThread FlsFree FlsSetValue FlsGetValue CreateDirectoryA CreateFileW DeleteFileA DeleteFileW GetVolumeInformationW WriteFile GetTempPathW IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcess ExitProcess GetExitCodeThread CreateProcessW OpenProcess GetLocalTime GetTickCount64 VirtualAllocEx WriteProcessMemory VirtualFreeEx IsWow64Process GetModuleHandleW GetProcAddress GetACP SetEndOfFile MoveFileExW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW OutputDebugStringA GlobalAlloc GlobalUnlock VirtualProtect GlobalFree MultiByteToWideChar VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA IsDBCSLeadByte ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection FormatMessageA SleepEx WaitForSingleObjectEx CreateThread GetFullPathNameW GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx LocalFree FlsAlloc RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable GetCurrentThreadId GetFileInformationByHandle SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetConsoleMode ReadConsoleW GetConsoleOutputCP LoadLibraryExW GetTimeZoneInformation GlobalLock HeapFree GetOEMCP FindClose FindFirstFileExW SetFilePointerEx GetCurrentDirectoryW MoveFileW IsValidCodePage FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW HeapSize MulDiv RtlUnwind GetDriveTypeW

user32

ReleaseCapture SetCapture GetClientRect SetCursorPos GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard SetCursor SetClipboardData CloseClipboard OpenClipboard SetProcessDpiAwarenessContext GetDpiForSystem IsWindowUnicode UpdateWindow SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetCursorPos ClientToScreen ScreenToClient LoadCursorA LoadIconW GetForegroundWindow GetClipboardData

shell32

SHGetFolderPathA ShellExecuteW ShellExecuteExW

advapi32

CryptReleaseContext RegQueryValueExA RegOpenKeyExA RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt CryptAcquireContextW

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

bcrypt

BCryptGenRandom

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

308KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_0de05f7e8beb6351e088c7af3b8a29cf_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

ws2_32

crypt32

iphlpapi

secur32

d3d11

d3dcompiler_47

ole32

oleaut32

kernel32

user32

shell32

advapi32

imm32

bcrypt

generic