2026-08-15_0ab59a86345fb35c1013a10792582240_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_0ab59a86345fb35c1013a10792582240_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 2.8MB
Sample260815-cdeehswhpb
SHA256 897f595854ef7789e7926787cdd626182c3f3f9d450506c0ce82505f629f0519
MD5 0ab59a86345fb35c1013a10792582240
SHA1 ccc2c9af381b83b2ae99f99a05dac906cc893277
SHA512 4cf5684660c25e2e68a5eda4488b5e84a503cc248a520bf07b8899151e9323256cd377689140e6c09f964a2f3da0b286717222fd6e0006224f234a0f37a6c8ac
SSDEEP 49152:Zd8dJs1i6AXViWAeH/1ISX1UUtGARE5WxAnp/P6B:NZjeH/1ISX1UUcARYl6B
TLSH
T14ED53A4BEAB601E0C5B6D139E142722BFDB234598334A7D79BD14B571BA27E0E87E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_0ab59a86345fb35c1013a10792582240_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-08-15_0ab59a86345fb35c1013a10792582240_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 2.8MB

2026-08-15_0ab59a86345fb35c1013a10792582240_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH 56d6e1b9ba7b9c2b91857ea584233558
SHA256 897f595854ef7789e7926787cdd626182c3f3f9d450506c0ce82505f629f0519
MD5 0ab59a86345fb35c1013a10792582240
SHA1 ccc2c9af381b83b2ae99f99a05dac906cc893277
SHA512 4cf5684660c25e2e68a5eda4488b5e84a503cc248a520bf07b8899151e9323256cd377689140e6c09f964a2f3da0b286717222fd6e0006224f234a0f37a6c8ac
SSDEEP 49152:Zd8dJs1i6AXViWAeH/1ISX1UUtGARE5WxAnp/P6B:NZjeH/1ISX1UUcARYl6B
TLSH
T14ED53A4BEAB601E0C5B6D139E142722BFDB234598334A7D79BD14B571BA27E0E87E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2074768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetColorizationColor DwmIsCompositionEnabled

shlwapi

PathFindFileNameW

shell32

ShellExecuteW ShellExecuteA SHFileOperationW SHGetFolderPathW ShellExecuteExW

crypt32

CertFreeCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateChain CryptDecodeObjectEx

ws2_32

htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect bind WSACleanup WSAStartup WSASetLastError listen WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt inet_ntop inet_pton freeaddrinfo getaddrinfo ntohl ioctlsocket sendto recvfrom ntohs gethostname

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid RegCloseKey RegDeleteValueW RegOpenKeyExW SystemFunction036 CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW ConvertSidToStringSidW RegDeleteTreeW OpenProcessToken AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid RegEnumValueW GetUserNameA RegCreateKeyExA RegDeleteKeyA SetSecurityInfo CopySid RegEnumKeyExW

kernel32

RtlUnwindEx SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetFilePointerEx WriteFile GetConsoleMode ReadConsoleW GetConsoleOutputCP LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetTimeZoneInformation GetExitCodeProcess CreatePipe SetStdHandle SetEndOfFile IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW Sleep GetModuleHandleW GetEnvironmentVariableW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW GetTempPathW CloseHandle WaitForSingleObject CreateProcessW GetWindowsDirectoryW GetModuleFileNameW OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask SetEnvironmentVariableW QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte CreateFileW GetFileAttributesA DecodePointer GetLastError AddVectoredExceptionHandler HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess GetCurrentProcessId FlsFree GetCurrentThreadId GetSystemDirectoryW VirtualProtect VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA AddDllDirectory SetDefaultDllDirectories QueryFullProcessImageNameW SetDllDirectoryW LocalFree SetLastError FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection LoadLibraryW SleepEx GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType RtlUnwind PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetFileSizeEx InitializeCriticalSection GetSystemInfo VirtualAlloc RtlLookupFunctionEntry RtlPcToFileHeader RaiseException OutputDebugStringW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo LCMapStringEx EncodePointer WakeAllConditionVariable GetFileInformationByHandleEx CopyFile2 AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetCurrentDirectoryW SleepConditionVariableSRW GetSystemTimePreciseAsFileTime GetLocaleInfoEx GetStringTypeW ExitThread FreeLibraryAndExitThread GetModuleHandleExW FlsAlloc FlsGetValue GetTickCount64 FlsSetValue ExitProcess TerminateProcess DuplicateHandle RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent CreateThread GetDriveTypeW FormatMessageA GetExitCodeThread WriteConsoleW QueryPerformanceCounter ReadFile

user32

MonitorFromWindow LoadCursorW ScreenToClient SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow IsWindowUnicode GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent SetProcessDPIAware GetClipboardData SetClipboardData EmptyClipboard MessageBoxA OpenClipboard ClientToScreen GetCursorPos GetWindowRect UpdateWindow GetSystemMetrics ReleaseCapture SetCapture SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage CloseClipboard GetKeyboardLayout

gdi32

CreateRectRgn GetDeviceCaps DeleteObject

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

httpapi

HttpSetUrlGroupProperty HttpCreateRequestQueue HttpInitialize HttpCreateUrlGroup HttpReceiveHttpRequest HttpCreateServerSession HttpAddUrlToUrlGroup HttpSendHttpResponse

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsFree DnsQuery_A

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

410KB

Virtual Size

410KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_0ab59a86345fb35c1013a10792582240_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

d3d11

d3dcompiler_47

dwmapi

shlwapi

shell32

crypt32

ws2_32

advapi32

kernel32

user32

gdi32

imm32

httpapi

psapi

wintrust

dnsapi

userenv

bcrypt

generic