70a92201c1c3212a8abb83bb847d0cdf779e86d6078bac5df2dbdcf7b28da85a

General

Target
2026-08-15_8b3cd790b8e973efc07e8c46f5f911a1_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 26.0MB
Sample260815-xt2vzasyht
SHA256 70a92201c1c3212a8abb83bb847d0cdf779e86d6078bac5df2dbdcf7b28da85a
MD5 8b3cd790b8e973efc07e8c46f5f911a1
SHA1 c7e141531b12407293b87eedf890264597da0813
SHA512 f221c0232afc2537a68938d6d7858989d31d3aec1522b8921ae34d9e0720a4b3cebb6b2ba2153ca436dcee837e7f498efa7a22c38cf7012160ef385177e3c6bf
SSDEEP 786432:3OiCndhsCJo7ZotScngiMaBOsTsXRgCr6uo:3OiQJoNotScgP6O8CuX
TLSH
T1645733487AE048FEE023F53E8447C44ADB2634A40737D5D703C6D66A2EA3EE36939579
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-08-15_8b3cd790b8e973efc07e8c46f5f911a1_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 26.0MB
- SHA256 70a92201c1c3212a8abb83bb847d0cdf779e86d6078bac5df2dbdcf7b28da85a
- MD5 8b3cd790b8e973efc07e8c46f5f911a1
- SHA1 c7e141531b12407293b87eedf890264597da0813
- SHA512 f221c0232afc2537a68938d6d7858989d31d3aec1522b8921ae34d9e0720a4b3cebb6b2ba2153ca436dcee837e7f498efa7a22c38cf7012160ef385177e3c6bf
- SSDEEP 786432:3OiCndhsCJo7ZotScngiMaBOsTsXRgCr6uo:3OiQJoNotScgP6O8CuX
- TLSH
  T1645733487AE048FEE023F53E8447C44ADB2634A40737D5D703C6D66A2EA3EE36939579
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2