Extracted

• • Target
    2026-08-16_f07363243df850d00e91dcc456f5d980_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
  • Size 16.9MB
  • SHA256 76b4ff0b016bc7a960b12d7c7eb69ffa5c5ead530368d3a771643775e6553121
  • MD5 f07363243df850d00e91dcc456f5d980
  • SHA1 4ee7280a5af4b5d11e36d028b303d76c30e1ee68
  • SHA512 a200904a4a8347686de5b5b7e1f647f3213e9bc72f23406422bf1ccf64dc14566242f97cd26fe3b3e5a7b79f72c932c515c802ebb41a10804917e94cbf5287e9
  • SSDEEP 393216:EqyCrd0n16INdq1B7LERYgDmHsn4qSyc0piG7PzPpW:Eq5rdq16INg1CsgzSn0p5zPA
  • TLSH
    T12D07339107C20666FAD7F13E16B29592D2A1B4902F3199EF0B64536B3F7B0E19C3B781
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionspywarestealerupx

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2