General
- Target 2026-08-17_1d105e22e4ea364ad69021fe46c2e621_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 67.9MB
- Sample260817-2nycta1eje
- SHA256 6d49ce076e239a3b2200b9267402d0ce3c4d8e7679ad31dd179fb51766a05148
- MD5 1d105e22e4ea364ad69021fe46c2e621
- SHA1 833b08897673b540030293be2f18ccc4576a2b39
- SHA512 03a4f6c908430c5607c808ce0810a652105e7887448711097f5fae830f255f2e410508093660e29987fbdd01ccb7db74a8149efe329f531d99906193e6badc82
- SSDEEP 1572864:zqq4f/sXJVrvo2pUg9NoX0R1Ph/Xahkv0m7m9Yrodh5uowK93P:kfSv7ig9NX19ahs0t2t5K1
- TLSH T16EF733617D1080BAE9E1413F4EA7DC62B19AA4F7877A93FF02F8111B2D9B1541C3C7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-08-17_1d105e22e4ea364ad69021fe46c2e621_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_1d105e22e4ea364ad69021fe46c2e621_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-17_1d105e22e4ea364ad69021fe46c2e621_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 67.9MB
- SHA256 6d49ce076e239a3b2200b9267402d0ce3c4d8e7679ad31dd179fb51766a05148
- MD5 1d105e22e4ea364ad69021fe46c2e621
- SHA1 833b08897673b540030293be2f18ccc4576a2b39
- SHA512 03a4f6c908430c5607c808ce0810a652105e7887448711097f5fae830f255f2e410508093660e29987fbdd01ccb7db74a8149efe329f531d99906193e6badc82
- SSDEEP 1572864:zqq4f/sXJVrvo2pUg9NoX0R1Ph/Xahkv0m7m9Yrodh5uowK93P:kfSv7ig9NX19ahs0t2t5K1
- TLSH T16EF733617D1080BAE9E1413F4EA7DC62B19AA4F7877A93FF02F8111B2D9B1541C3C7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.