2026-08-09_6bdbb089ab27e5b38e10cc09927d547c_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_6bdbb089ab27e5b38e10cc09927d547c_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc
Size 16.7MB
Sample260809-hjkrdaseqa
SHA256 8d95acb81c8905121c2f9b8c9e36d1d6a5b2ccfda85812a1d337448068ee5fa2
MD5 6bdbb089ab27e5b38e10cc09927d547c
SHA1 e6ae42d3e5e38b65e3afd438aae1a8b7f8402665
SHA512 d24ccac71d042c9a049fe61eed9e72c458049d8505b964eff02d77cdab0ec1ff2103ab6fda6a807f14969dc3f150d30e254afbc31cb946f20a05e3dae0ebd915
SSDEEP 393216:q+SfHn11RV3gRmL+cXe4aDRo7l5RTLOUYgOUY:aTLIELR
TLSH
T18F07BF69A6BC01E9E467C1BCC6965223EB72B41523B057CF5A609AF60F23BD01E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_6bdbb089ab27e5b38e10cc09927d547c_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-08-09_6bdbb089ab27e5b38e10cc09927d547c_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

.exe 16.7MB

2026-08-09_6bdbb089ab27e5b38e10cc09927d547c_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

IMPHASH 424ff249241236bb580074f49544c30e
SHA256 8d95acb81c8905121c2f9b8c9e36d1d6a5b2ccfda85812a1d337448068ee5fa2
MD5 6bdbb089ab27e5b38e10cc09927d547c
SHA1 e6ae42d3e5e38b65e3afd438aae1a8b7f8402665
SHA512 d24ccac71d042c9a049fe61eed9e72c458049d8505b964eff02d77cdab0ec1ff2103ab6fda6a807f14969dc3f150d30e254afbc31cb946f20a05e3dae0ebd915
SSDEEP 393216:q+SfHn11RV3gRmL+cXe4aDRo7l5RTLOUYgOUY:aTLIELR
TLSH
T18F07BF69A6BC01E9E467C1BCC6965223EB72B41523B057CF5A609AF60F23BD01E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17428480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

OpenProcessToken GetTokenInformation RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegDeleteTreeW SetEntriesInAclW SetNamedSecurityInfoW RegEnumKeyExW RegEnumValueW RegGetValueW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatusEx CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash EventRegister EventSetInformation EventWriteTransfer EventUnregister CryptDestroyKey CryptGenRandom CryptSetHashParam ReportEventW CryptEnumProvidersW CryptSignHashW CryptDecrypt RegisterEventSourceW DeregisterEventSource CryptGetProvParam CryptGetUserKey CryptExportKey

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider

crypt32

CertGetNameStringW CryptQueryObject CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CryptBinaryToStringA CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CryptMsgGetParam CryptMsgClose CertFindCertificateInStore CertOpenSystemStoreW CertEnumCertificatesInStore CertOpenStore CertGetCertificateContextProperty CertCloseStore CertDuplicateCertificateContext

iphlpapi

GetAdaptersAddresses if_nametoindex

ncrypt

NCryptDeleteKey NCryptFinalizeKey NCryptCreatePersistedKey NCryptOpenStorageProvider NCryptFreeObject

wintrust

WinVerifyTrust

comctl32

InitCommonControlsEx

shell32

SHGetFolderPathW ShellExecuteExW ShellExecuteW SHGetPathFromIDListW SHBrowseForFolderW

ole32

CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemAlloc CoTaskMemFree CoInitialize CreateStreamOnHGlobal StringFromGUID2 CoCreateGuid CoSetProxyBlanket PropVariantClear

gdiplus

GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipSetPenLineJoin GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen1 GdipCreateLineBrushI GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDeleteRegion GdipCreateRegionPath GdipScaleMatrix GdipGetImageHeight GdipDeleteMatrix GdipCreateMatrix GdipTransformPath GdipAddPathRectangle GdipAddPathBezier GdipAddPathArc GdipAddPathLine GdipClosePathFigure GdipStartPathFigure GdipDeletePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipCreateImageAttributes GdipCreateBitmapFromStream GdipResetClip GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipTranslateMatrix GdipDrawLine GdipDrawEllipse GdipDrawPath GdipFillRectangleI GdipFillEllipse GdipFillPath GdipDrawImageRectRect GdipSetClipRegion GdipSetInterpolationMode

dwmapi

DwmSetWindowAttribute

ws2_32

recv WSAWaitForMultipleEvents WSAGetLastError ntohs WSAStartup WSACleanup accept bind connect getpeername getsockname WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt GetNameInfoW ioctlsocket htonl setsockopt freeaddrinfo htons closesocket getaddrinfo select listen WSASocketA recvfrom sendto inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport getservbyname shutdown __WSAFDIsSet WSAIoctl WSASetLastError socket

secur32

InitSecurityInterfaceW

kernel32

IsDebuggerPresent SetConsoleCtrlHandler SetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo LCMapStringEx DecodePointer EncodePointer SleepConditionVariableSRW WakeAllConditionVariable ExitProcess GetFileInformationByHandleEx CopyFile2 AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFinalPathNameByHandleW GetFileAttributesExW FindFirstFileExW GetCurrentDirectoryW GetLocaleInfoEx UnhandledExceptionFilter HeapAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers HeapReAlloc SetEndOfFile GetConsoleOutputCP IsProcessorFeaturePresent GetStringTypeW RtlCaptureContext IsValidCodePage GetOEMCP GetTimeZoneInformation GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW HeapSize SetFilePointerEx RtlVirtualUnwind ConvertThreadToFiberEx ConvertFiberToThread GetACP CreateSemaphoreA GetExitCodeThread ReleaseSemaphore InitializeCriticalSection LoadLibraryA GetSystemDirectoryA GetModuleHandleExW FindNextFileW FindFirstFileW GetCommandLineW CreateFileW GetFileSizeEx ReadFile WriteFile GetTempPathW CloseHandle GetLastError ReleaseMutex WaitForSingleObject CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess GetTickCount64 FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW LocalFree QueryFullProcessImageNameW MoveFileExW MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW GetTickCount GlobalAlloc GlobalUnlock GlobalLock GlobalFree MulDiv GetSystemDirectoryW CreateDirectoryW DeleteFileW GetLocalTime GetModuleHandleW WideCharToMultiByte GetDiskFreeSpaceExW GetEnvironmentVariableW SystemTimeToFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageA SleepEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter QueryPerformanceFrequency InitializeConditionVariable GetFullPathNameW GetEnvironmentVariableA CompareFileTime GetSystemTimeAsFileTime VerSetConditionMask VerifyVersionInfoW WakeConditionVariable SleepConditionVariableCS WaitForSingleObjectEx CreateThread GetFileAttributesW OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree LoadLibraryW GetFileType GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualProtect VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetSystemTime FindClose RtlUnwind

user32

SetForegroundWindow MessageBoxW EnumWindows GetClassNameW GetMessageW TranslateMessage DispatchMessageW PeekMessageW SendMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW IsWindow DestroyWindow BringWindowToTop SetCapture ReleaseCapture SetTimer KillTimer GetSystemMetrics DrawTextW UpdateWindow GetDC ReleaseDC BeginPaint EndPaint InvalidateRect SetWindowTextW GetClientRect ScreenToClient PtInRect LoadCursorW LoadIconW GetWindowLongPtrW SetWindowLongPtrW EnumChildWindows GetProcessWindowStation GetUserObjectInformationW PostMessageW ShowWindow IsWindowVisible IsIconic

gdi32

SetBkMode SetTextColor SelectObject EnumFontFamiliesExW DeleteObject DeleteDC CreateSolidBrush CreateFontW CreateCompatibleDC CreateCompatibleBitmap GetDeviceCaps BitBlt

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

winhttp

WinHttpCloseHandle WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryOption WinHttpQueryDataAvailable WinHttpReadData WinHttpOpen WinHttpCrackUrl WinHttpConnect WinHttpSetStatusCallback

wininet

InternetTimeToSystemTimeW

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

210KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9.9MB

Virtual Size

9.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

95KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcd003

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_6bdbb089ab27e5b38e10cc09927d547c_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

advapi32

bcrypt

crypt32

iphlpapi

ncrypt

wintrust

comctl32

shell32

ole32

gdiplus

dwmapi

ws2_32

secur32

kernel32

user32

gdi32

oleaut32

winhttp

wininet

generic