c3e0cf31acaa6b0a9e84715d5986baa23f832272202b81fffc38f2ec9490a629

General

Target
2026-08-15_7647efc74d4f4ab0d2d5312a83733ab7_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_satacom_stealc_vidar_zxxz
Size 131.3MB
Sample260815-btaktsw1ft
SHA256 c3e0cf31acaa6b0a9e84715d5986baa23f832272202b81fffc38f2ec9490a629
MD5 7647efc74d4f4ab0d2d5312a83733ab7
SHA1 ca65a258d1abd58aece230f26be9745ce7e05491
SHA512 010a49c65bd9b68f777124e7686efc4ad34aacdae4a88739a2e8bfeee39d1f76f501e9583d455d11d111d54fde31e3ec86de39b12de16eaa657f8f2b6ca7858d
SSDEEP 1572864:dBeI7yCDsW/oRSX1f8eRvZD/dB6vCbJnkPZJwvdnEDncn1V:dBeIZMSXJBVd3JkBJwvdnELKP
TLSH
T1E268E016B3A104A6D437C134CABB5507EB7274065730D3EB36AC0369AF63BE49A7B724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_7647efc74d4f4ab0d2d5312a83733ab7_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_satacom_stealc_vidar_zxxz
- Size 131.3MB
- SHA256 c3e0cf31acaa6b0a9e84715d5986baa23f832272202b81fffc38f2ec9490a629
- MD5 7647efc74d4f4ab0d2d5312a83733ab7
- SHA1 ca65a258d1abd58aece230f26be9745ce7e05491
- SHA512 010a49c65bd9b68f777124e7686efc4ad34aacdae4a88739a2e8bfeee39d1f76f501e9583d455d11d111d54fde31e3ec86de39b12de16eaa657f8f2b6ca7858d
- SSDEEP 1572864:dBeI7yCDsW/oRSX1f8eRvZD/dB6vCbJnkPZJwvdnEDncn1V:dBeIZMSXJBVd3JkBJwvdnELKP
- TLSH
  T1E268E016B3A104A6D437C134CABB5507EB7274065730D3EB36AC0369AF63BE49A7B724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence spyware stealer trojan
- UAC bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2