General
- Target 2026-08-23_676571a23f9856d6b8d23cf57ccbe801_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 76.1MB
- Sample260824-lzaswseq4y
- SHA256 0045498f3e3ea7c1c3bc38ff763ecf375c8017cbf9965d3ba25a9876ef35739c
- MD5 676571a23f9856d6b8d23cf57ccbe801
- SHA1 7193bd12878be563a98f23c1500f2cdcd7b260e0
- SHA512 9fb0793ee810acafcd9c33bad890a55867481bb5abc61c09a01d7a784b12ba157a522a42cd362564de4ed332b77b19ecabae6c2ddc21d384fd4233a47306a5a0
- SSDEEP 1572864:bPas/X2heCDzTSM+dy2J0f0/rBdsG7bpip0WWPNNvK4C2c6F2QSCGK1B:DPCvI5BB7tE0WJ4pUQSCb
- TLSH T1BD0833249D15626BF28E5736D1A2D4533BBE71CA4F7280AD42D4C9879BA31C2CDBC873
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-08-23_676571a23f9856d6b8d23cf57ccbe801_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_676571a23f9856d6b8d23cf57ccbe801_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260710-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_676571a23f9856d6b8d23cf57ccbe801_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 76.1MB
- SHA256 0045498f3e3ea7c1c3bc38ff763ecf375c8017cbf9965d3ba25a9876ef35739c
- MD5 676571a23f9856d6b8d23cf57ccbe801
- SHA1 7193bd12878be563a98f23c1500f2cdcd7b260e0
- SHA512 9fb0793ee810acafcd9c33bad890a55867481bb5abc61c09a01d7a784b12ba157a522a42cd362564de4ed332b77b19ecabae6c2ddc21d384fd4233a47306a5a0
- SSDEEP 1572864:bPas/X2heCDzTSM+dy2J0f0/rBdsG7bpip0WWPNNvK4C2c6F2QSCGK1B:DPCvI5BB7tE0WJ4pUQSCb
- TLSH T1BD0833249D15626BF28E5736D1A2D4533BBE71CA4F7280AD42D4C9879BA31C2CDBC873
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.