General
- Target 2026-08-20_671d1a78e16275b07ba3b0bbb9c7140e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 80.1MB
- Sample260821-ae3gmage35
- SHA256 021c9168da040c82f822bbadd9cf55b711f8364b5ab64546568771d9c98854e0
- MD5 671d1a78e16275b07ba3b0bbb9c7140e
- SHA1 436498fc3a2f612132eae27c8b98dbd251fade45
- SHA512 99df73b9087a37b5454ef413e645ccfa289293da4ec3d29231cee65fc6a500cb9e4680725acbf81aee502ab672604fecc4cdf5d2779b222ddb68566f401d5e3c
- SSDEEP 1572864:Wqq4f/yJA2YEUZl7XNyjhQR5QMJJ8R/E0/utd0xyfPhNXahk30m7m7+5bsw+iP:RfFEQlLgaR55oR/E0/kd0xkraho0tK9Z
- TLSH T1EA083384FE4221FBEAA545315A429C63F68921CF8767C2EF1A9462373F3B3106E35D94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Behavioral task
behavioral1
Sample
2026-08-20_671d1a78e16275b07ba3b0bbb9c7140e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_671d1a78e16275b07ba3b0bbb9c7140e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_671d1a78e16275b07ba3b0bbb9c7140e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 80.1MB
- SHA256 021c9168da040c82f822bbadd9cf55b711f8364b5ab64546568771d9c98854e0
- MD5 671d1a78e16275b07ba3b0bbb9c7140e
- SHA1 436498fc3a2f612132eae27c8b98dbd251fade45
- SHA512 99df73b9087a37b5454ef413e645ccfa289293da4ec3d29231cee65fc6a500cb9e4680725acbf81aee502ab672604fecc4cdf5d2779b222ddb68566f401d5e3c
- SSDEEP 1572864:Wqq4f/yJA2YEUZl7XNyjhQR5QMJJ8R/E0/utd0xyfPhNXahk30m7m7+5bsw+iP:RfFEQlLgaR55oR/E0/kd0xkraho0tK9Z
- TLSH T1EA083384FE4221FBEAA545315A429C63F68921CF8767C2EF1A9462373F3B3106E35D94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Loads dropped DLL
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1