General
- Target 2026-08-19_3b2c0090af79b271ccb636766b8a8c37_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom
- Size 12.6MB
- Sample260819-kghv4sea82
- SHA256 c394bebb06321d759b8783a297c84a2fe49034700798661f9ce39d1f137002c7
- MD5 3b2c0090af79b271ccb636766b8a8c37
- SHA1 d5d31f1305a04a8700db3d99e0d6b0bc5d92ea05
- SHA512 5717620514a4e306db4015002cb104527a24bf09e858c7bce51a9584cd63dc8fc6ebebeefbdcd9318f4b7dd56aeca863f747e6467956d7a93d5767ed84ab4cb4
- SSDEEP 196608:xTqlYdkXZCpzMV8Zr/K5Tafr3J8LowAP1xc2zfZhHDE3YuCJ0ocyav1UoK0:xTQYmXZ4zMaSIrJ886GZN92A06ob
- TLSH T176D633BAE66615EAD97FD5B8AC488D08C65AFD031352C9FFE720358F9A1B0D01837907
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_3b2c0090af79b271ccb636766b8a8c37_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_3b2c0090af79b271ccb636766b8a8c37_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-19_3b2c0090af79b271ccb636766b8a8c37_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom
- Size 12.6MB
- SHA256 c394bebb06321d759b8783a297c84a2fe49034700798661f9ce39d1f137002c7
- MD5 3b2c0090af79b271ccb636766b8a8c37
- SHA1 d5d31f1305a04a8700db3d99e0d6b0bc5d92ea05
- SHA512 5717620514a4e306db4015002cb104527a24bf09e858c7bce51a9584cd63dc8fc6ebebeefbdcd9318f4b7dd56aeca863f747e6467956d7a93d5767ed84ab4cb4
- SSDEEP 196608:xTqlYdkXZCpzMV8Zr/K5Tafr3J8LowAP1xc2zfZhHDE3YuCJ0ocyav1UoK0:xTQYmXZ4zMaSIrJ886GZN92A06ob
- TLSH T176D633BAE66615EAD97FD5B8AC488D08C65AFD031352C9FFE720358F9A1B0D01837907
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables Discord URL observed in first stage droppers
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.