2f8d51e427ef2495b1d5ba514e18d6ef1f34a3fda9a748bb5902a04dc4a2d8ae

General

Target
2026-08-13_5e6be4cd0525f193007adba4a22792fc_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 33.2MB
Sample260813-sqaj4ashkc
SHA256 2f8d51e427ef2495b1d5ba514e18d6ef1f34a3fda9a748bb5902a04dc4a2d8ae
MD5 5e6be4cd0525f193007adba4a22792fc
SHA1 fa7e7c593ad4252f634675bd22c0176b8ad65f47
SHA512 6f515a235319142a41cf2ebccf8631c796cee33078d2e615a7f68e8933cd6dd56ac6afe6d80c7e4ee1f51cc489be1eaedca7ed199ee83900681e90944850df71
SSDEEP 786432:UDq/Brp4hodmUJAGr7qFKA0ZFGLkc1bsat5Ike8yqzGw4OyA7WB/3PW6y:UDq/7JAGreI3ZFMpjG8dzGwPk/3PW6
TLSH
T1617733483B5221DBFAD8653A41F7D651F2B095961F30CBEF07A823AA3B539D40D388D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-13_5e6be4cd0525f193007adba4a22792fc_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 33.2MB
- SHA256 2f8d51e427ef2495b1d5ba514e18d6ef1f34a3fda9a748bb5902a04dc4a2d8ae
- MD5 5e6be4cd0525f193007adba4a22792fc
- SHA1 fa7e7c593ad4252f634675bd22c0176b8ad65f47
- SHA512 6f515a235319142a41cf2ebccf8631c796cee33078d2e615a7f68e8933cd6dd56ac6afe6d80c7e4ee1f51cc489be1eaedca7ed199ee83900681e90944850df71
- SSDEEP 786432:UDq/Brp4hodmUJAGr7qFKA0ZFGLkc1bsat5Ike8yqzGw4OyA7WB/3PW6y:UDq/7JAGreI3ZFMpjG8dzGwPk/3PW6
- TLSH
  T1617733483B5221DBFAD8653A41F7D651F2B095961F30CBEF07A823AA3B539D40D388D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VirtualBox drivers on disk
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2