blankgrabber | b389212f1945bb3fc5301ea6ddabd73cccc8589e60292aae13ef67403edf8242

General

Target
2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
Size 94.6MB
Sample260815-exbtvaep7s
SHA256 b389212f1945bb3fc5301ea6ddabd73cccc8589e60292aae13ef67403edf8242
MD5 22cbed315fea32c67fe69eed54f7b8c2
SHA1 5a115739e6c8dac43b1f3442a618b02e00e1b82e
SHA512 26bf6c347b7c4de01ca91603d6ee2c0351ed5826c96bc9b16a6f21f75965c1c842a2b367d7b30b039983d986b39c1e1d0f37d220d7020c534dd4986f7d8c84fc
SSDEEP 393216:9MlP9e/xG2QPTnzy/ioekthGxBUclpPvneT5sL:9MXtvbG/iGDGxB/+5sL
TLSH
T1BF283361311519EEF361CA7C8846ED346C263C190E27C74F422C4B766F936AA5E2F73A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_22cbed315fea32c67fe69eed54f7b8c2_cobalt-strike_glassworm_icedid_njrat_satacom_vidar
- Size 94.6MB
- SHA256 b389212f1945bb3fc5301ea6ddabd73cccc8589e60292aae13ef67403edf8242
- MD5 22cbed315fea32c67fe69eed54f7b8c2
- SHA1 5a115739e6c8dac43b1f3442a618b02e00e1b82e
- SHA512 26bf6c347b7c4de01ca91603d6ee2c0351ed5826c96bc9b16a6f21f75965c1c842a2b367d7b30b039983d986b39c1e1d0f37d220d7020c534dd4986f7d8c84fc
- SSDEEP 393216:9MlP9e/xG2QPTnzy/ioekthGxBUclpPvneT5sL:9MXtvbG/iGDGxB/+5sL
- TLSH
  T1BF283361311519EEF361CA7C8846ED346C263C190E27C74F422C4B766F936AA5E2F73A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2