431a6c001668b918b36c6c0bca87e633cabe8fe09a4bbad17f1357347c5fd841

General

Target
2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 28.1MB
Sample260816-e4ybesbc32
SHA256 431a6c001668b918b36c6c0bca87e633cabe8fe09a4bbad17f1357347c5fd841
MD5 5ceb4a572e7cf4734c6ac3f3c4955fc6
SHA1 c7247971b2c2ac8851129f8f3085a3aa2d942e92
SHA512 18b396fbca67cb1173dbfe1bc78faed2b8dbc795d5671226cbf8c23ea88cdd4515f183989da4a90ddbe0e94825e595f0d4bfccd7151cec4e52ddcb49977a689e
SSDEEP 786432:abS4ce2snwMvh5odmUJAzRphFBo+RiZaLV7rtGvF7gL:R4f/VwJAzPhHiZaV3UgL
TLSH
T1AE573399376118FAF8D912386CC4DD6AE3F175520B90C2AB0BF45E661C2B1D8DF38B91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-16_5ceb4a572e7cf4734c6ac3f3c4955fc6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 28.1MB
- SHA256 431a6c001668b918b36c6c0bca87e633cabe8fe09a4bbad17f1357347c5fd841
- MD5 5ceb4a572e7cf4734c6ac3f3c4955fc6
- SHA1 c7247971b2c2ac8851129f8f3085a3aa2d942e92
- SHA512 18b396fbca67cb1173dbfe1bc78faed2b8dbc795d5671226cbf8c23ea88cdd4515f183989da4a90ddbe0e94825e595f0d4bfccd7151cec4e52ddcb49977a689e
- SSDEEP 786432:abS4ce2snwMvh5odmUJAzRphFBo+RiZaLV7rtGvF7gL:R4f/VwJAzPhHiZaV3UgL
- TLSH
  T1AE573399376118FAF8D912386CC4DD6AE3F175520B90C2AB0BF45E661C2B1D8DF38B91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access discovery execution persistence privilege_escalation pyinstaller ransomware spyware stealer
- Renames multiple (9980) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops Chrome extension
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2