2026-08-10_bb7bf1b4e784dee86c52200f10d881ef_blankgrabber_cobalt-strike_glassworm_hijackloader_icedid_njrat_remcos_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_bb7bf1b4e784dee86c52200f10d881ef_blankgrabber_cobalt-strike_glassworm_hijackloader_icedid_njrat_remcos_satacom_stealc
Size 31.7MB
Sample260810-cfdwrsde57
SHA256 eaa5e83ffb49e8b58d7d11035a441b130f3f9a6f13bd209790e2edfc57dc4bd0
MD5 bb7bf1b4e784dee86c52200f10d881ef
SHA1 005557225bd2ee9ba23c1c35ef86c16d2e5f1e8d
SHA512 ed3706bd95473e118c211633713f89c504e7cfb69f5a2613d827ad5af1e38779c28e7ae9b2baec538517972f5756ea842ed9602c7370aed4a08eade9a105e22f
SSDEEP 393216:rAuXbAvduDQrQ/sKHznt3yu2vOdZjpBt6MwFv+CIUi87Bt6MwFv+CIUi8YY:rAu0uDQr2znt3yaZt44
TLSH
T1FB77E056F7A601F8D0A7C138C6979617E77278850332AACF53E089692F677E05B3BB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

themida

Malware Config

Signatures

Detects executables packed with Enigma 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Enigma

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_bb7bf1b4e784dee86c52200f10d881ef_blankgrabber_cobalt-strike_glassworm_hijackloader_icedid_njrat_remcos_satacom_stealc

File Explorer

2026-08-10_bb7bf1b4e784dee86c52200f10d881ef_blankgrabber_cobalt-strike_glassworm_hijackloader_icedid_njrat_remcos_satacom_stealc

.exe 31.7MB

2026-08-10_bb7bf1b4e784dee86c52200f10d881ef_blankgrabber_cobalt-strike_glassworm_hijackloader_icedid_njrat_remcos_satacom_stealc

IMPHASH c5d33189c1366c0d3510a200aa14a4c2
SHA256 eaa5e83ffb49e8b58d7d11035a441b130f3f9a6f13bd209790e2edfc57dc4bd0
MD5 bb7bf1b4e784dee86c52200f10d881ef
SHA1 005557225bd2ee9ba23c1c35ef86c16d2e5f1e8d
SHA512 ed3706bd95473e118c211633713f89c504e7cfb69f5a2613d827ad5af1e38779c28e7ae9b2baec538517972f5756ea842ed9602c7370aed4a08eade9a105e22f
SSDEEP 393216:rAuXbAvduDQrQ/sKHznt3yu2vOdZjpBt6MwFv+CIUi87Bt6MwFv+CIUi8YY:rAu0uDQr2znt3yaZt44
TLSH
T1FB77E056F7A601F8D0A7C138C6979617E77278850332AACF53E089692F677E05B3BB01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with Enigma
Detects executables packed with Themida
Detects executables packed with VMProtect.
Detects executables referencing many IR and analysis tools
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

921968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

wininet

InternetOpenA InternetQueryOptionA HttpOpenRequestA InternetOpenUrlA InternetReadFile InternetSetOptionW InternetConnectA HttpSendRequestA InternetCloseHandle HttpQueryInfoA InternetSetOptionA

bcrypt

BCryptGenRandom BCryptCreateHash BCryptFinishHash BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider BCryptHashData BCryptEncrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptDecrypt BCryptDestroyKey

crypt32

CryptUnprotectData CryptStringToBinaryA CryptProtectData CryptBinaryToStringA

shell32

SHGetFolderPathA ShellExecuteExW ord680 ShellExecuteW

ole32

CoCreateInstance CoInitializeEx CreateStreamOnHGlobal CoUninitialize

user32

LoadCursorW GetWindowTextW ReleaseDC GetClassNameW GetForegroundWindow GetSystemMetrics MessageBoxW GetDC SetProcessDpiAwarenessContext GetWindowThreadProcessId MessageBoxA GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData EnableWindow DefWindowProcW GetWindowRect DestroyWindow SetWindowPos SetWindowLongPtrW CreateWindowExW SendMessageW UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow IsWindow DispatchMessageW PeekMessageW TranslateMessage LoadIconW EnumDisplayDevicesA PostQuitMessage UpdateWindow SetForegroundWindow GetDpiForSystem GetCursorPos

gdi32

DeleteDC DeleteObject SelectObject CreateCompatibleBitmap BitBlt CreateCompatibleDC

gdiplus

GdipSaveImageToStream GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdiplusStartup

advapi32

RegOpenKeyExA GetUserNameA RegCloseKey InitializeAcl SetSecurityInfo RegEnumKeyExA

kernel32

IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation VirtualProtect GetConsoleMode GetConsoleOutputCP HeapFree HeapAlloc GetFileType UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetExitCodeThread WaitForSingleObjectEx SleepConditionVariableSRW GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx CopyFile2 IsValidCodePage GetACP GetOEMCP HeapReAlloc GetCommandLineA GetCommandLineW GetEnvironmentStringsW LoadLibraryExW AreFileApisANSI CreateFile2 GetDateFormatW SetFileInformationByHandle GetFileInformationByHandle GetFileAttributesExW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize SetLastError WriteFile OutputDebugStringA GetEnvironmentVariableW CreateMutexW CreateToolhelp32Snapshot Sleep CopyFileA GetLastError Process32NextW CreateFileA Process32FirstW CloseHandle GetLocalTime ExitProcess WideCharToMultiByte CreateDirectoryA FlushFileBuffers ReadFile GetFileSizeEx GetFileAttributesExA GetCurrentProcess TerminateProcess GetEnvironmentVariableA WaitForSingleObject GetModuleHandleA OpenProcess GetTempPathA GetTickCount64 MoveFileExA DeleteFileA GetNativeSystemInfo SetFileAttributesA RtlUnwind SetFilePointerEx GetCurrentProcessId GlobalMemoryStatusEx GetModuleHandleW CreateProcessA GetDiskFreeSpaceExA IsWow64Process GetComputerNameA GetExitCodeProcess GetSystemTimeAsFileTime LocalFree MoveFileA GetModuleFileNameA FindFirstFileA FindNextFileA SetFilePointer SetEndOfFile FindClose GetFileAttributesA RemoveDirectoryA GetTempFileNameA LocalAlloc MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW WriteConsoleW GetProcAddress FindNextFileW FindFirstFileExW FindFirstFileW CreateDirectoryW FormatMessageA GetLocaleInfoEx

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

597KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.arch

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xtls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp2

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma1

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma2

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dsstext

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_bb7bf1b4e784dee86c52200f10d881ef_blankgrabber_cobalt-strike_glassworm_hijackloader_icedid_njrat_remcos_satacom_stealc

d3d11

wininet

bcrypt

crypt32

shell32

ole32

user32

gdi32

gdiplus

advapi32

kernel32

imm32

d3dcompiler_47

generic