blankgrabber | d6df1ff613304535c8f8beb96f2ed671c515194f34b2576c499dc93eaaeb4aa8

General

Target
2026-08-19_32c5fd018afefedb088869cb524c85f9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 10.0MB
Sample260820-att4sszsev
SHA256 d6df1ff613304535c8f8beb96f2ed671c515194f34b2576c499dc93eaaeb4aa8
MD5 32c5fd018afefedb088869cb524c85f9
SHA1 19c402f807045a9ac8a3b2661050e2e7266d21ef
SHA512 aa90c22905f22fe9509c51697c9f8c8f806795579fdbe1ff1540fd35b87b38ad7cdf2eeb15d84bc563859bbbfb84836a749e3717cd62b82ad38217003823a321
SSDEEP 98304:xzHqdVfB2M3zg8yuT/9vUIdD9C+z3zO917vOTh+ezDNh7qMJ1nfOBmRqn4mpUJhe:dQsMDNbT/9bvLz3S1bA3zNn2gRCkqd
TLSH
T1AFB633AAA3D205F5E4B39A3DC2D28449DA7075270768DACF03F053A52F17AD44E3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-19_32c5fd018afefedb088869cb524c85f9_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 10.0MB
- SHA256 d6df1ff613304535c8f8beb96f2ed671c515194f34b2576c499dc93eaaeb4aa8
- MD5 32c5fd018afefedb088869cb524c85f9
- SHA1 19c402f807045a9ac8a3b2661050e2e7266d21ef
- SHA512 aa90c22905f22fe9509c51697c9f8c8f806795579fdbe1ff1540fd35b87b38ad7cdf2eeb15d84bc563859bbbfb84836a749e3717cd62b82ad38217003823a321
- SSDEEP 98304:xzHqdVfB2M3zg8yuT/9vUIdD9C+z3zO917vOTh+ezDNh7qMJ1nfOBmRqn4mpUJhe:dQsMDNbT/9bvLz3S1bA3zNn2gRCkqd
- TLSH
  T1AFB633AAA3D205F5E4B39A3DC2D28449DA7075270768DACF03F053A52F17AD44E3BB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection credential_access defense_evasion discovery execution spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Drops file in Drivers directory
- Clipboard Data
  Adversaries may collect data stored in the clipboard from users copying information within or between applications.
  collection
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2