46cb9eef03ac5c4fcd083b656e10b524afd27bc83eb52bed92e5c29237dcee24

General

Target
2026-08-17_1028424f25164f551e5092341a8b2977_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 31.0MB
Sample260817-tvaakacd95
SHA256 46cb9eef03ac5c4fcd083b656e10b524afd27bc83eb52bed92e5c29237dcee24
MD5 1028424f25164f551e5092341a8b2977
SHA1 84d696d33e1945ddc482c866a43404e7b3235997
SHA512 fa37e0e1eea50c5f61035a7cfa76dd00dc4575d181a505b104eaed4b573357fa6d10f9cf438e3d6fbb9c0f2ef05b97818c80a4c348d6bd07c470abec59d185b2
SSDEEP 786432:5Dq/BrquOodmUJAf0ns+BmVp5C4pznUByBEZ8BY+I6:5Dq/kQJAczEpXzwaI2Y+I6
TLSH
T1ED6733163BA301CAFAC4213E91B2DE85A131594B1F94CFFF0BE822EB76570D61D351A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-17_1028424f25164f551e5092341a8b2977_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 31.0MB
- SHA256 46cb9eef03ac5c4fcd083b656e10b524afd27bc83eb52bed92e5c29237dcee24
- MD5 1028424f25164f551e5092341a8b2977
- SHA1 84d696d33e1945ddc482c866a43404e7b3235997
- SHA512 fa37e0e1eea50c5f61035a7cfa76dd00dc4575d181a505b104eaed4b573357fa6d10f9cf438e3d6fbb9c0f2ef05b97818c80a4c348d6bd07c470abec59d185b2
- SSDEEP 786432:5Dq/BrquOodmUJAf0ns+BmVp5C4pznUByBEZ8BY+I6:5Dq/kQJAczEpXzwaI2Y+I6
- TLSH
  T1ED6733163BA301CAFAC4213E91B2DE85A131594B1F94CFFF0BE822EB76570D61D351A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Enumerates VirtualBox DLL files
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VirtualBox drivers on disk
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare drivers on disk
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2