General
- Target 2026-08-11_416c2cb716bc081a1d9ad95352577d8b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 36.3MB
- Sample260811-2vlmlaem7x
- SHA256 caafd8bc92ec4e4097b365a0352fcf2789d6db203324f55d86b2298fe0754663
- MD5 416c2cb716bc081a1d9ad95352577d8b
- SHA1 19f0ea4378e03d33ece162e82756d474c880164d
- SHA512 f7883c0d91b25d69f5704f215627db488d1701814eb1783efbd4eb0d8fcc55b2ec248e17da345e353cb7505b3fb24da45267c5273776058a14b10eb05876d56c
- SSDEEP 786432:wnwHljSYGuPYcW8Mzfa7KZ30AnGCnk02PBD+gEwvTi2nR2esaxmxBnPNoKmemBpI:wn4jS6W9a7KZEAnGCnk0+BDOysPPPNo
- TLSH T19C8733897BD508D5FDDA053884E6A523AAB8BCAA1B59C0CF0AE534130D771E5ED3CB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-11_416c2cb716bc081a1d9ad95352577d8b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_416c2cb716bc081a1d9ad95352577d8b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-11_416c2cb716bc081a1d9ad95352577d8b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 36.3MB
- SHA256 caafd8bc92ec4e4097b365a0352fcf2789d6db203324f55d86b2298fe0754663
- MD5 416c2cb716bc081a1d9ad95352577d8b
- SHA1 19f0ea4378e03d33ece162e82756d474c880164d
- SHA512 f7883c0d91b25d69f5704f215627db488d1701814eb1783efbd4eb0d8fcc55b2ec248e17da345e353cb7505b3fb24da45267c5273776058a14b10eb05876d56c
- SSDEEP 786432:wnwHljSYGuPYcW8Mzfa7KZ30AnGCnk02PBD+gEwvTi2nR2esaxmxBnPNoKmemBpI:wn4jS6W9a7KZEAnGCnk0+BDOysPPPNo
- TLSH T19C8733897BD508D5FDDA053884E6A523AAB8BCAA1B59C0CF0AE534130D771E5ED3CB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1