General
- Target 2026-08-18_4a521a785517f9dac09f196f6b77d7b5_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom
- Size 11.3MB
- Sample260818-fpzrdaem5w
- SHA256 97c8b89f3f5f09e90c87c0c5d22354c8eb6778ea1b445624757e220d2b01a5ec
- MD5 4a521a785517f9dac09f196f6b77d7b5
- SHA1 f405135c34a09163b77f21fbf21af365ed20a852
- SHA512 50d99a9cdc9e2bc6e9b11bcbb27a8b5efd690e287671752a7f61e1a5303346b8779e526afdcf5e1710296db1236e8c7417b1e09924cc4339a903c919d3581c31
- SSDEEP 196608:OVB3wcYYRUWtHtR+rM7YNIR6cK4If0dVOW5hPnWVAmsHLwlR8mfHwUDzjF6c9mHp:OVBgINRd7YNIRPjOWrnWaDHqTfHw8B6Z
- TLSH T1EAC6331091A546F6CA8B94BE515C6544F77BBF672BB183EF4692E2B01F232E0483F613
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-18_4a521a785517f9dac09f196f6b77d7b5_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_4a521a785517f9dac09f196f6b77d7b5_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-18_4a521a785517f9dac09f196f6b77d7b5_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom
- Size 11.3MB
- SHA256 97c8b89f3f5f09e90c87c0c5d22354c8eb6778ea1b445624757e220d2b01a5ec
- MD5 4a521a785517f9dac09f196f6b77d7b5
- SHA1 f405135c34a09163b77f21fbf21af365ed20a852
- SHA512 50d99a9cdc9e2bc6e9b11bcbb27a8b5efd690e287671752a7f61e1a5303346b8779e526afdcf5e1710296db1236e8c7417b1e09924cc4339a903c919d3581c31
- SSDEEP 196608:OVB3wcYYRUWtHtR+rM7YNIR6cK4If0dVOW5hPnWVAmsHLwlR8mfHwUDzjF6c9mHp:OVBgINRd7YNIRPjOWrnWaDHqTfHw8B6Z
- TLSH T1EAC6331091A546F6CA8B94BE515C6544F77BBF672BB183EF4692E2B01F232E0483F613
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables containing URLs to raw contents of a Github gist
-
Loads dropped DLL