2026-08-20_da3261187e4373bc300d4190bb1b0267_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

General

Target
2026-08-20_da3261187e4373bc300d4190bb1b0267_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 17.4MB
Sample260820-vhh8da1fpf
SHA256 9f9ff7b4a2a44c8186750f05af9413a90e98e8bcb9600dcc625d476a48d301ce
MD5 da3261187e4373bc300d4190bb1b0267
SHA1 c14c2a43018db9e48e0282cb8efffe02e9e5c150
SHA512 990644412fdcdeddcce75101de8caaf1a093ec6794f668d40373e9ae6010c3d828c23d386c1430b4abd9e68d1fd32ee740b033b02f338a85a1e6a09b938d2405
SSDEEP 98304:jMqkBgFK2EU+Ys1Bo35IPSP0FJfOw4b53wKm54han6AKz+1+0ngRgyMgHlREYNmy:iBmDSHSPedt+0negHgjEYoMqjK9
TLSH
T118074C0333704052FFB2E0B58CA98622DF77B85A57157293256CCB692BD7ED69ABC304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_da3261187e4373bc300d4190bb1b0267_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-08-20_da3261187e4373bc300d4190bb1b0267_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

.exe 17.4MB

2026-08-20_da3261187e4373bc300d4190bb1b0267_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH a7243c223dba547855990a72d7eb0784
SHA256 9f9ff7b4a2a44c8186750f05af9413a90e98e8bcb9600dcc625d476a48d301ce
MD5 da3261187e4373bc300d4190bb1b0267
SHA1 c14c2a43018db9e48e0282cb8efffe02e9e5c150
SHA512 990644412fdcdeddcce75101de8caaf1a093ec6794f668d40373e9ae6010c3d828c23d386c1430b4abd9e68d1fd32ee740b033b02f338a85a1e6a09b938d2405
SSDEEP 98304:jMqkBgFK2EU+Ys1Bo35IPSP0FJfOw4b53wKm54han6AKz+1+0ngRgyMgHlREYNmy:iBmDSHSPedt+0negHgjEYoMqjK9
TLSH
T118074C0333704052FFB2E0B58CA98622DF77B85A57157293256CCB692BD7ED69ABC304
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8925976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

python313

PyWideStringList_Append PyConfig_SetString PyConfig_SetArgv PyThreadState_Get Py_SetProgramName Py_InitializeFromConfig Py_ExitStatusException PySys_SetArgv _PyConfig_InitCompatConfig Py_DebugFlag Py_VerboseFlag Py_InteractiveFlag Py_InspectFlag Py_OptimizeFlag Py_NoSiteFlag Py_BytesWarningFlag Py_FrozenFlag Py_IgnoreEnvironmentFlag Py_DontWriteBytecodeFlag Py_NoUserSiteDirectory Py_UTF8Mode PyImport_FrozenModules PyMem_Malloc PyMem_GetAllocator PyType_Ready PyObject_Str PyObject_RichCompare PyObject_RichCompareBool PyObject_SetAttrString PyObject_SetAttr PyObject_SelfIter PyObject_GenericSetAttr PyObject_IsTrue PyCallable_Check PyObject_ClearWeakRefs _Py_Dealloc PyObject_CallFinalizerFromDealloc PyObject_Realloc PyObject_Free PyObject_Init _PyObject_New _PyObject_GC_Resize PyObject_GC_Del PyByteArray_FromStringAndSize PyBytes_FromString PyBytes_AsString PyUnicode_FromStringAndSize PyUnicode_FromEncodedObject PyUnicode_FromWideChar PyUnicode_AsWideCharString PyUnicode_FromOrdinal PyUnicode_DecodeUTF8 PyUnicode_Concat PyUnicode_FindChar PyUnicode_Format PyUnicode_New PyUnicode_AsUTF8 PyErr_SetObject PyErr_GivenExceptionMatches PyErr_ExceptionMatches PyErr_BadArgument PyErr_NoMemory PyOS_snprintf _Py_FatalErrorFunc PyLong_AsLongAndOverflow PyLong_AsSsize_t PyLong_FromString PyLong_FromUnicodeObject _PyLong_New _PyLong_Copy PyFloat_FromString PyFloat_FromDouble PyComplex_FromDoubles PyDict_DelItemString PyList_New PyList_Sort PyDict_New PyDict_GetItem PyDict_GetItemString PyDict_SetItemString PyCMethod_New PyModule_NewObject PyModule_GetName PyModule_GetFilenameObject PyModule_GetDef PyUnstable_Code_NewWithPosOnlyArgs PyCode_Addr2Line PyErr_WarnEx PyArg_ParseTuple PyArg_ParseTupleAndKeywords PyArg_UnpackTuple Py_BuildValue PyModule_ExecDef PyModule_FromDefAndSpec2 PyErr_Print Py_CompileStringExFlags PyEval_EvalCodeEx PyEval_GetFuncName PyEval_RestoreThread _PyEval_EvalFrameDefault PySys_WriteStderr PyImport_ExecCodeModule PyImport_ExecCodeModuleEx PyImport_GetModuleDict PyImport_ImportModule PyImport_ImportFrozenModule PyObject_Call PyObject_CallFunctionObjArgs PyObject_CallMethodObjArgs PyObject_GetIter PyIter_Next PyIter_Send PyNumber_Add PyNumber_Subtract PyNumber_FloorDivide PyNumber_Float PyNumber_InPlaceAdd PyNumber_InPlaceLshift PyNumber_InPlaceOr PyNumber_ToBase PySequence_List PySequence_InPlaceConcat PyMapping_Check PyObject_LengthHint PyMarshal_ReadObjectFromString _PyErr_FormatFromCause _PyErr_SetString _PyUnicode_InternImmortal _PyArg_NoKeywords _PySet_NextEntry _PyByteArray_empty_string PyExc_OverflowError PyExc_RecursionError PyExc_ZeroDivisionError PyExc_ImportWarning PyDictKeys_Type PyDictValues_Type PyDictItems_Type PySet_Type PyFrozenSet_Type PyModuleDef_Type PyFunction_Type PyMethod_Type PyCode_Type PyFrame_Type PyTraceBack_Type PyEllipsis_Type PyGen_Type PyCoro_Type PyAsyncGen_Type Py_GenericAliasType _PyRuntime _PyIntrinsics_UnaryFunctions PyStatus_Exception PyList_SetSlice PyList_Size PyLong_AsLong PyErr_SetInterrupt PyExc_MemoryError PyMemoryView_Type PyByteArray_FromObject PyExc_NameError PyExc_UnboundLocalError PyNumber_Invert PyObject_Dir PyObject_GetAttr PySlice_Type PyDict_MergeFromSeq2 PyDict_Merge PyNumber_Negative PyExc_IOError PyFrozenSet_New PyLong_FromVoidPtr PyReversed_Type PyMap_Type _Py_EllipsisObject PyRange_Type PyComplex_Type PyFloat_Type PyExc_AssertionError _Py_NotImplementedStruct PyExc_NotImplementedError PyExc_RuntimeError PyExc_StopAsyncIteration PyEnum_Type PyExc_UnicodeEncodeError PyExc_UnicodeError PyBool_Type PyObject_DelItem PyObject_Repr PyBytes_Type PyProperty_Type PyLong_Type PySet_Add PyByteArray_Type PyFilter_Type PyZip_Type PyExc_OSError PyExc_UnicodeDecodeError PyExc_LookupError PyDict_Type PyTuple_Type PyExc_ValueError PyExc_SystemExit PyExc_KeyboardInterrupt PyExc_BaseException PySequence_Tuple PyNumber_Long PyObject_GetItem _PyDict_NewPresized PyDict_DelItem PyUnicode_FromFormat _PyObject_FunctionStr PySeqIter_Type PyList_Type PyExc_KeyError PyExc_ImportError PyExc_GeneratorExit PyExc_StopIteration _PyThreadState_GetCurrent PyObject_IsSubclass PySequence_Contains PySequence_Check PyObject_SetItem PyEval_AcquireThread PyEval_SaveThread Py_MakePendingCalls Py_Exit Py_GenericAlias PySet_Contains PySet_New PyLong_FromSsize_t PyErr_WriteUnraisable PyUnicode_Join PyExc_IndexError PyNumber_AsSsize_t PyModule_Type PyExc_Exception PyUnicode_Type PyErr_PrintEx PyModule_GetDict PyDict_SetItem PyUnicode_Find PyUnicode_GetLength PyUnicode_Substring PyObject_GetAttrString PyType_IsSubtype PyCFunction_Type PyExc_TypeError PyExc_SystemError PyExc_AttributeError _Py_NoneStruct PyBaseObject_Type PyType_Type PyObject_IsInstance PyErr_Format _PyType_Lookup _Py_TrueStruct _Py_FalseStruct PySys_SetObject PySys_GetObject PyStructSequence_SetItem PyStructSequence_New PyStructSequence_InitType PyCapsule_New PyUnicode_FromString PyTuple_New

kernel32

WriteConsoleW HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose MultiByteToWideChar GetFileType LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetStdHandle SetConsoleCtrlHandler GetCommandLineW GetCommandLineA GetModuleHandleExW RtlPcToFileHeader RaiseException EncodePointer FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError RtlUnwindEx GetEnvironmentVariableA GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentThreadId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WideCharToMultiByte FindResourceA FormatMessageA LockResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleA GetModuleFileNameW GetSystemTimeAsFileTime GetCurrentProcessId SetErrorMode WriteFile GetShortPathNameW CreateFileW SetEnvironmentVariableW GetEnvironmentVariableW SetDllDirectoryW OpenProcess CreateThread ExitProcess Sleep WaitForSingleObject GetLastError CloseHandle SetStdHandle

Name

.text

Size

8.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

186KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

322KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8.4MB

Virtual Size

8.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_da3261187e4373bc300d4190bb1b0267_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

python313

kernel32

generic