General
- Target 2026-08-16_9ec7027e2ee7cf8d74b65582961770dd_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 19.6MB
- Sample260816-lm7bbsvtav
- SHA256 390c896dd5f9d0a1708751d453d1b60bf2459b017bf829d3f1f3507933fef309
Malware Config
Targets
-
- Target 2026-08-16_9ec7027e2ee7cf8d74b65582961770dd_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 19.6MB
- SHA256 390c896dd5f9d0a1708751d453d1b60bf2459b017bf829d3f1f3507933fef309
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target cookie_dump_obf.pyc
- Size 49KB
- SHA256 7f2648839669d97f3daeaaa17ebfe049ca561c10ce5c5a754f7c423996d12259
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Modify Authentication Process
1Defense Evasion
Modify Authentication Process
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1