2026-08-08_a1cf2804b36c0f6319ba2da394bc53dc_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_a1cf2804b36c0f6319ba2da394bc53dc_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 2.7MB
Sample260808-ffrdmstwew
SHA256 4a2c8dc801120631e011c7ec2fcd6a10dab1f6dbaced4851dfc29a4398d57b48
MD5 a1cf2804b36c0f6319ba2da394bc53dc
SHA1 db8b48ece01f30168481ef4265763adde46aa399
SHA512 332eca1db98decf57ebd47e499cb4b5ac728e2bd0b0c7ed1a82a6c50090238ff406221a5a7ad71ebedd6f8bf92f6cfed16c0e75cbc69609f5bd50c909fa3260a
SSDEEP 49152:i/PUExHd3HF+AYuJ7neCpyrA1roDNH0TQ2kDbD46QfQpqd9poiBAFbHwpGNG9PSo:iN3JleCpyrsoDR0UBmd9poiBAFbHe
TLSH
T1C1D59E57A3B900ECD177C1B8CA168613EBB2B85513309BDF4790CE662F23AE15A7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_a1cf2804b36c0f6319ba2da394bc53dc_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-08-08_a1cf2804b36c0f6319ba2da394bc53dc_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 2.7MB

2026-08-08_a1cf2804b36c0f6319ba2da394bc53dc_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 38c207cebb3541d1aa6e397088f0887d
SHA256 4a2c8dc801120631e011c7ec2fcd6a10dab1f6dbaced4851dfc29a4398d57b48
MD5 a1cf2804b36c0f6319ba2da394bc53dc
SHA1 db8b48ece01f30168481ef4265763adde46aa399
SHA512 332eca1db98decf57ebd47e499cb4b5ac728e2bd0b0c7ed1a82a6c50090238ff406221a5a7ad71ebedd6f8bf92f6cfed16c0e75cbc69609f5bd50c909fa3260a
SSDEEP 49152:i/PUExHd3HF+AYuJ7neCpyrA1roDNH0TQ2kDbD46QfQpqd9poiBAFbHwpGNG9PSo:iN3JleCpyrsoDR0UBmd9poiBAFbHe
TLSH
T1C1D59E57A3B900ECD177C1B8CA168613EBB2B85513309BDF4790CE662F23AE15A7E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2039792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CryptQueryObject CertFreeCertificateChain CryptStringToBinaryA CertGetNameStringW CertFindExtension CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptBinaryToStringA CertGetCertificateChain

advapi32

CryptDestroyHash CryptReleaseContext CryptAcquireContextW RegEnumKeyExW RegQueryValueExW RegOpenKeyExW RegQueryValueExA RegOpenKeyExA RegCloseKey GetUserNameA CryptCreateHash CryptHashData CryptGetHashParam

kernel32

FreeEnvironmentStringsW GetTempPathA CloseHandle WaitForSingleObject GetCurrentThread CreateProcessA GetTickCount64 GetComputerNameA SetConsoleOutputCP GetFileAttributesA GetLastError OpenProcess FormatMessageA CreateToolhelp32Snapshot Process32First Process32Next FreeLibrary GetProcAddress LoadLibraryA LocalFree CreateFileA DeleteFileA ReadFile WriteFile ConnectNamedPipe GetOverlappedResult CancelIo CreateEventA GetCurrentProcessId TerminateProcess CreateNamedPipeA GetModuleHandleA CreateFileW FindClose FindFirstFileA GetFinalPathNameByHandleW SetFilePointer DuplicateHandle GetCurrentProcess CreateThread TerminateThread MultiByteToWideChar GetModuleHandleW FindNextFileA GetEnvironmentVariableA SetDllDirectoryA FlushFileBuffers GetTickCount VirtualProtect IsDebuggerPresent GetSystemInfo GetSystemDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile LoadLibraryW Sleep WideCharToMultiByte SetEnvironmentVariableW Process32NextW QueryPerformanceCounter GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc HeapReAlloc DeleteFileW WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate GetFileAttributesW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError SleepEx InitializeCriticalSectionEx MoveFileExW QueryPerformanceFrequency InitializeConditionVariable VerSetConditionMask VerifyVersionInfoW GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects WakeConditionVariable SleepConditionVariableCS GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage SetStdHandle GetTimeZoneInformation GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA GetModuleFileNameW IsProcessorFeaturePresent SetFilePointerEx GetConsoleOutputCP ReadConsoleW GetConsoleMode FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW ExitProcess FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetStringTypeW GetCPInfo WriteConsoleW Process32FirstW CompareStringEx LCMapStringEx GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime RtlPcToFileHeader InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable SleepConditionVariableSRW FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW EncodePointer DecodePointer RtlUnwind

shell32

SHGetFolderPathA

bcrypt

BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider BCryptGenRandom BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey

secur32

InitSecurityInterfaceW

ws2_32

htonl freeaddrinfo getaddrinfo select __WSAFDIsSet WSAIoctl WSASetLastError socket setsockopt recv ntohs htons getsockname getpeername connect closesocket bind accept WSACleanup listen WSAGetLastError WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt recvfrom sendto gethostname ioctlsocket WSAStartup

iphlpapi

if_nametoindex

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

435KB

Virtual Size

434KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_a1cf2804b36c0f6319ba2da394bc53dc_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

crypt32

advapi32

kernel32

shell32

bcrypt

secur32

ws2_32

iphlpapi

generic