2026-08-13_73dafc7ec9c233f82045ac283641b6fa_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom

General

Target
2026-08-13_73dafc7ec9c233f82045ac283641b6fa_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom
Size 18.5MB
Sample260813-e8fl6sbl2z
SHA256 1a967325e9bd100d219a1106ae9570af1b4594bf769a6b8e2c0ed36dc613db29
MD5 73dafc7ec9c233f82045ac283641b6fa
SHA1 7a9d6f9742c9f6d6e2e4227a0490b05bf2c61c54
SHA512 6031c062e459905d8d96ba6b99551cddd2823964855ea347368af6b26c539e4010da545aefdba42aec68340295a65da023567ceefe2fe37d2fe63d29728b109d
SSDEEP 393216:mPqZKwO/3SZWxnG+me3Xr9FMAhn76ZkiE8XJEr/0DAmpCyrdtnGZX2VF12BkxQ:sGcSZZ03Xr9FMAhnyy8XJiWAmptdEZXx
TLSH
T1AB17333875C06CE6E9AB61B461610E79E33A3C95834CD1EB167EB138D9678A0053EF73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_73dafc7ec9c233f82045ac283641b6fa_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom

File Explorer

2026-08-13_73dafc7ec9c233f82045ac283641b6fa_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom

.exe 18.5MB

2026-08-13_73dafc7ec9c233f82045ac283641b6fa_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom

IMPHASH e00bf6bc4b1b25fce30fd26a5e135ee4
SHA256 1a967325e9bd100d219a1106ae9570af1b4594bf769a6b8e2c0ed36dc613db29
MD5 73dafc7ec9c233f82045ac283641b6fa
SHA1 7a9d6f9742c9f6d6e2e4227a0490b05bf2c61c54
SHA512 6031c062e459905d8d96ba6b99551cddd2823964855ea347368af6b26c539e4010da545aefdba42aec68340295a65da023567ceefe2fe37d2fe63d29728b109d
SSDEEP 393216:mPqZKwO/3SZWxnG+me3Xr9FMAhn76ZkiE8XJEr/0DAmpCyrdtnGZX2VF12BkxQ:sGcSZZ03Xr9FMAhnyy8XJiWAmptdEZXx
TLSH
T1AB17333875C06CE6E9AB61B461610E79E33A3C95834CD1EB167EB138D9678A0053EF73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

50176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHFileOperationW SHGetFolderPathW CommandLineToArgvW

kernel32

FlsGetValue WriteConsoleW HeapReAlloc CreateDirectoryW SizeofResource SetConsoleCtrlHandler AddDllDirectory GetCommandLineW GetStdHandle WriteFile GetShortPathNameW TerminateProcess GetModuleFileNameW SetEnvironmentVariableW K32GetModuleFileNameExW GetEnvironmentVariableW GetTempPathW FindResourceA WaitForSingleObject CreateFileW GetFileAttributesW GetModuleHandleA OpenProcess Sleep GetLastError LockResource CloseHandle LoadResource GetProcAddress GetCurrentProcessId CreateProcessW WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA SetDllDirectoryW LoadLibraryExW GetExitCodeProcess QueryPerformanceCounter GetCurrentThreadId InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW HeapSize RtlUnwindEx SetLastError FlsAlloc FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent GetCommandLineA RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc MultiByteToWideChar HeapFree VirtualProtect LCMapStringW GetFileType GetStringTypeW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx

Name

.text

Size

137KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18.3MB

Virtual Size

18.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_73dafc7ec9c233f82045ac283641b6fa_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom

shell32

kernel32

generic