General
- Target 2026-08-20_fbd92ec83040cb168b496a68240e16e4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 17.7MB
- Sample260820-ex46dszarc
- SHA256 429ee0068e44d2c57683c7d99c9196da604e8308ede9208fd348ebb492f95cb8
- MD5 fbd92ec83040cb168b496a68240e16e4
- SHA1 12fbaf841130663cc6a05c774a8b91ae389dd8cc
- SHA512 02361cd6d0916887722077190a5766e6c6857965ebfc2a051e3459f7061366b30c8961df456a6560b311ad46cf37fb5ae3224356d85fd97268a761b996ac7ff1
- SSDEEP 393216:grbVW88I0DuCa8SkELwqk0IEU+Rd8rFk7iYpljYg1:gXVW88ITCa8ShVmcRdEk2clEg1
- TLSH T1D317334C7BE901D8DAEDD23D84C2891AA3A6B91117F8C9C75AF84D600DB32D0DD75BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-08-20_fbd92ec83040cb168b496a68240e16e4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_fbd92ec83040cb168b496a68240e16e4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_fbd92ec83040cb168b496a68240e16e4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 17.7MB
- SHA256 429ee0068e44d2c57683c7d99c9196da604e8308ede9208fd348ebb492f95cb8
- MD5 fbd92ec83040cb168b496a68240e16e4
- SHA1 12fbaf841130663cc6a05c774a8b91ae389dd8cc
- SHA512 02361cd6d0916887722077190a5766e6c6857965ebfc2a051e3459f7061366b30c8961df456a6560b311ad46cf37fb5ae3224356d85fd97268a761b996ac7ff1
- SSDEEP 393216:grbVW88I0DuCa8SkELwqk0IEU+Rd8rFk7iYpljYg1:gXVW88ITCa8ShVmcRdEk2clEg1
- TLSH T1D317334C7BE901D8DAEDD23D84C2891AA3A6B91117F8C9C75AF84D600DB32D0DD75BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.