2026-08-14_3188fe35c5ad383311f42324551d2bdb_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_3188fe35c5ad383311f42324551d2bdb_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc
Size 8.2MB
Sample260814-tkrrvsel41
SHA256 16f3150306c294849eefb93ecbb5b13d9d29dda09ef48cd32327030fc476c874
MD5 3188fe35c5ad383311f42324551d2bdb
SHA1 b3c7890bb6a449fb774c2828c1f645dcf6e022ab
SHA512 0572a7d0f69defaef30532c19004a2196b427ed7828e291b3692aefd5d8602cbb150876e25cfdfbe33fc4d1dd72e80b2b70f1eb09d7156cfe024583f3b38356e
SSDEEP 98304:wXj9S0C2/bIa2ulkYfEqk6DdbIges+kUfmwbEXev8wcFOvkSxMy5/Dn:A8w/Ua2ulkYcqk6DdbIg/riwOUgBRD
TLSH
T13496CF69A6BC01D9E867C2BDC2965227EB72B415237057CF1A609AF60F23AD41F7F700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_3188fe35c5ad383311f42324551d2bdb_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-08-14_3188fe35c5ad383311f42324551d2bdb_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

.exe 8.2MB

2026-08-14_3188fe35c5ad383311f42324551d2bdb_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

IMPHASH 7f6a7f21a96e206c1a34eb7b0135f802
SHA256 16f3150306c294849eefb93ecbb5b13d9d29dda09ef48cd32327030fc476c874
MD5 3188fe35c5ad383311f42324551d2bdb
SHA1 b3c7890bb6a449fb774c2828c1f645dcf6e022ab
SHA512 0572a7d0f69defaef30532c19004a2196b427ed7828e291b3692aefd5d8602cbb150876e25cfdfbe33fc4d1dd72e80b2b70f1eb09d7156cfe024583f3b38356e
SSDEEP 98304:wXj9S0C2/bIa2ulkYfEqk6DdbIges+kUfmwbEXev8wcFOvkSxMy5/Dn:A8w/Ua2ulkYcqk6DdbIg/riwOUgBRD
TLSH
T13496CF69A6BC01D9E867C2BDC2965227EB72B415237057CF1A609AF60F23AD41F7F700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8615936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegDeleteValueW RegOpenKeyExW CredDeleteW RegGetValueW OpenProcessToken GetTokenInformation RegQueryValueExW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatusEx CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCreateKeyExW RegSetValueExW SetEntriesInAclW SetNamedSecurityInfoW ConvertSidToStringSidW ChangeServiceConfigW ControlService QueryServiceStatus StartServiceW CryptDestroyKey CryptGenRandom CryptSetHashParam ReportEventW CryptEnumProvidersW RegisterEventSourceW DeregisterEventSource CryptSignHashW CryptGetProvParam CryptDecrypt CryptGetUserKey CryptExportKey

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash

crypt32

CertCloseStore CertFindCertificateInStore CryptQueryObject CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CryptMsgGetParam CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertFreeCertificateContext CryptBinaryToStringA CertOpenSystemStoreW CryptMsgClose CertEnumCertificatesInStore CertOpenStore CertGetCertificateContextProperty CertGetNameStringW CertDuplicateCertificateContext

iphlpapi

GetAdaptersAddresses if_nametoindex

ncrypt

NCryptOpenKey NCryptFreeObject NCryptDeleteKey NCryptFinalizeKey NCryptCreatePersistedKey NCryptOpenStorageProvider NCryptSignHash

wintrust

WinVerifyTrust

comctl32

InitCommonControlsEx

dwmapi

DwmSetWindowAttribute

gdiplus

GdipDrawLine GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipSetPenEndCap GdipDrawImageRectRect GdipDeletePen GdipCreatePen1 GdipCreateLineBrushI GdipFillRectangleI GdipDeleteBrush GdipDeleteRegion GdipCreateRegionPath GdipResetClip GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix GdipTransformPath GdipAddPathRectangle GdipAddPathBezier GdipAddPathArc GdipAddPathLine GdipClosePathFigure GdipStartPathFigure GdipDeletePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipCreateSolidFill GdipFillPath GdipSetClipRegion GdipSetPenStartCap GdipScaleMatrix

ole32

CoTaskMemAlloc PropVariantClear CoUninitialize CoInitializeEx CreateStreamOnHGlobal CoSetProxyBlanket CoCreateInstance

oleaut32

SysFreeString SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElement SysAllocString VariantClear VariantInit

shell32

SHGetFolderPathW ShellExecuteExW CommandLineToArgvW ShellExecuteW

ws2_32

ntohs WSAStartup WSAGetLastError WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSACleanup getsockopt GetNameInfoW closesocket connect getpeername getsockname htons recv WSASetLastError WSAIoctl __WSAFDIsSet listen WSASocketA setsockopt sendto inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport getservbyname shutdown socket select getaddrinfo freeaddrinfo htonl ioctlsocket accept send bind recvfrom

secur32

InitSecurityInterfaceW

kernel32

IsProcessorFeaturePresent ExitProcess HeapFree SetFilePointerEx SetConsoleCtrlHandler SetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer SleepConditionVariableSRW WakeAllConditionVariable IsDebuggerPresent GetStringTypeW GetFileInformationByHandleEx CopyFile2 AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFinalPathNameByHandleW GetFileAttributesW FindFirstFileExW GetCurrentDirectoryW GetLocaleInfoEx LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers HeapReAlloc SetEndOfFile IsValidCodePage GetOEMCP RtlCaptureContext UnhandledExceptionFilter HeapAlloc GetTimeZoneInformation GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW HeapSize GetConsoleOutputCP LoadLibraryW RtlVirtualUnwind ConvertThreadToFiberEx ConvertFiberToThread GetACP CreateSemaphoreA GetExitCodeThread ReleaseSemaphore InitializeCriticalSection LoadLibraryA GetCommandLineW GetTempPathW CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess GetModuleFileNameW LocalFree QueryFullProcessImageNameW CompareStringOrdinal CreateToolhelp32Snapshot Process32FirstW Process32NextW GetTickCount LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MulDiv CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesExW WriteFile GetCurrentThreadId GetLocalTime GetTickCount64 GetModuleHandleW GetProcAddress MoveFileW MultiByteToWideChar WideCharToMultiByte GetDiskFreeSpaceExW GetCurrentProcess GetSystemDirectoryW MoveFileExW CopyFileW GetFileSizeEx ReadFile ReleaseMutex CreateMutexW GetProcessId GetEnvironmentVariableW GetWindowsDirectoryW SystemTimeToFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageA SleepEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter QueryPerformanceFrequency InitializeConditionVariable GetFullPathNameW GetEnvironmentVariableA CompareFileTime GetSystemTimeAsFileTime VerSetConditionMask VerifyVersionInfoW WakeConditionVariable SleepConditionVariableCS WaitForSingleObjectEx CreateThread GetFileType GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualProtect VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetSystemTime FindClose FindFirstFileW FindNextFileW GetModuleHandleExW GetSystemDirectoryA FreeLibrary RtlUnwind

user32

ShowWindow BringWindowToTop SetCapture ReleaseCapture SetTimer KillTimer GetSystemMetrics DrawTextW UpdateWindow SetForegroundWindow GetDC ReleaseDC BeginPaint EndPaint InvalidateRect GetClientRect ScreenToClient DestroyWindow LoadCursorW LoadIconW AttachThreadInput IsWindowVisible IsIconic GetForegroundWindow AllowSetForegroundWindow GetWindowTextLengthW GetWindowRect GetWindowLongW EnumWindows GetWindowThreadProcessId GetWindow MessageBoxW GetProcessWindowStation GetUserObjectInformationW CreateWindowExW RegisterClassExW TranslateMessage GetMessageW PostQuitMessage DefWindowProcW PostMessageW DispatchMessageW PtInRect

gdi32

SetBkMode SetTextColor SelectObject EnumFontFamiliesExW DeleteObject DeleteDC CreateSolidBrush CreateFontW CreateCompatibleDC CreateCompatibleBitmap GetDeviceCaps BitBlt

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetStatusCallback WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryOption WinHttpSetOption WinHttpSetTimeouts

wininet

InternetTimeToSystemTimeW

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

211KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

95KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_3188fe35c5ad383311f42324551d2bdb_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

advapi32

bcrypt

crypt32

iphlpapi

ncrypt

wintrust

comctl32

dwmapi

gdiplus

ole32

oleaut32

shell32

ws2_32

secur32

kernel32

user32

gdi32

winhttp

wininet

generic