2026-08-23_2c9ff68970bbd0efaa7098772d3d65af_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-23_2c9ff68970bbd0efaa7098772d3d65af_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc
Size 995KB
Sample260824-sapdbahn61
SHA256 1321883a60d7cfb3869ab858c3e9bfb5aa8922ed36b64cddfc5f67cd484762a9
MD5 2c9ff68970bbd0efaa7098772d3d65af
SHA1 79fb56b1bf79d2e5f46ba464223650d65df92a9c
SHA512 36069d3f7b69f0ca4bf8f29b5a3a22b47a75518be8762c504855b7020b9f4d4a7814c4be03ac45e4e7608cdf6d587672263b4fe43a37bace7fdf7a69dd8c0daf
SSDEEP 12288:/U+XAtQ1snzz+lKBt07haZ8mc4WAvIvg8mbdNZ8W4p2wL:/U+QtQenP+lKBt07ha2mxAvTJ2wL
TLSH
T1F4259F15B2F401E9E0A7C0799A57861BD5B0BC861331CACF02A0EB656F37AF60E7E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-23_2c9ff68970bbd0efaa7098772d3d65af_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

.exe 995KB

2026-08-23_2c9ff68970bbd0efaa7098772d3d65af_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

IMPHASH a617d67e7e282e618d1258173c34ef02
SHA256 1321883a60d7cfb3869ab858c3e9bfb5aa8922ed36b64cddfc5f67cd484762a9
MD5 2c9ff68970bbd0efaa7098772d3d65af
SHA1 79fb56b1bf79d2e5f46ba464223650d65df92a9c
SHA512 36069d3f7b69f0ca4bf8f29b5a3a22b47a75518be8762c504855b7020b9f4d4a7814c4be03ac45e4e7608cdf6d587672263b4fe43a37bace7fdf7a69dd8c0daf
SSDEEP 12288:/U+XAtQ1snzz+lKBt07haZ8mc4WAvIvg8mbdNZ8W4p2wL:/U+QtQenP+lKBt07ha2mxAvTJ2wL
TLSH
T1F4259F15B2F401E9E0A7C0799A57861BD5B0BC861331CACF02A0EB656F37AF60E7E751
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

15:b3:19:82:3d:34:c6:86:61:06:35:cc:10:a7:d6:4a:e1:63:20:35:bb:0c:40:e4:6d:72:91:7f:87:a4:d7:c6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=683-88-02252,CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Aug 21, 2026

SERIALNUMBER=683-88-02252,CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=683-88-02252,CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

7b:c4:02:71:65:a3:31:ab:ff:67:67:17:cc:79:44:e5:44:32:4c:1a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=683-88-02252,CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Aug 21, 2026

SERIALNUMBER=683-88-02252,CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=683-88-02252,CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=683-88-02252,CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Serial Number

2b:6b:ea:ca:b9:c9:55:77:6c:52:c4:bb:e1:61:9f:3f

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 18, 2026 - Mar 18, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

511928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\devel\ark7\bin.win32\Updater.x64.pdb

kernel32

OpenProcess TerminateProcess GetSystemInfo HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW LocalAlloc FileTimeToLocalFileTime GetModuleHandleExW lstrcmpW MulDiv VerSetConditionMask VerifyVersionInfoW DeleteCriticalSection InitializeCriticalSectionEx SetFilePointerEx WriteFile lstrlenA RtlCaptureContext GlobalMemoryStatusEx CreateThread ExitProcess SetUnhandledExceptionFilter GetCurrentThreadId Sleep InitializeCriticalSection CreateEventW SetEvent EnterCriticalSection LeaveCriticalSection RaiseException SetLastError GetUserDefaultUILanguage WritePrivateProfileStringW GetWindowsDirectoryW GetUserDefaultLangID lstrcmpiW GetPrivateProfileIntW CreateMutexW DecodePointer VirtualQuery WriteConsoleW FlushFileBuffers GetConsoleMode GetCurrentProcessId SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW GetOEMCP GetACP IsValidCodePage GetCPInfo GetStringTypeW HeapQueryInformation GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle GetCommandLineW GetCommandLineA FreeLibraryAndExitThread ExitThread SetConsoleCtrlHandler TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent WaitForSingleObject CreateProcessW MultiByteToWideChar WideCharToMultiByte LoadLibraryW GetSystemDirectoryW LoadLibraryExW SetFileAttributesW lstrcpyW FindNextFileW GetFullPathNameW LocalFree GetFileSizeEx GetFileSize GetFileAttributesW lstrlenW DeleteFileW GetTempFileNameW GetTempPathW GetModuleFileNameW GetCurrentThread GetCurrentProcess FreeLibrary GetProcAddress GetModuleHandleW GetTimeZoneInformation FileTimeToSystemTime GetSystemTimeAsFileTime FindClose ReadFile SetFilePointer CreateFileW GetTickCount64 OutputDebugStringW CloseHandle GetConsoleOutputCP GetLastError

user32

GetPropW RemovePropW SetPropW GetKeyState GetClassInfoExW RegisterClassExW IsWindowEnabled GetWindow UnionRect DestroyCursor SetTimer KillTimer EndPaint BeginPaint GetSysColor SetFocus GetFocus DestroyWindow EnableWindow EndDialog GetWindowTextLengthW DestroyIcon PostMessageW EnumChildWindows SetWindowTextW GetDlgCtrlID SetWindowRgn SetScrollPos SetScrollRange SetScrollInfo GetWindowDC RegisterClassW CreateIconFromResource LoadCursorFromFileW UpdateWindow TrackMouseEvent FindWindowW SendMessageW GetSystemMetrics SystemParametersInfoW GetWindowRect MonitorFromRect GetMonitorInfoW CopyRect MonitorFromPoint OffsetRect EqualRect GetMessageW DialogBoxParamW GetActiveWindow SetParent SetDlgItemTextW GetClassInfoW CharNextW DrawFocusRect MonitorFromWindow MessageBoxW WaitForInputIdle ChangeWindowMessageFilter SendMessageTimeoutW LoadIconW MoveWindow GetWindowLongW SetWindowPos ScreenToClient AdjustWindowRectEx ShowWindow CallWindowProcW ClientToScreen PeekMessageW TranslateMessage DispatchMessageW PostQuitMessage IsWindow GetParent GetDesktopWindow FindWindowExW GetWindowThreadProcessId IsWindowVisible GetWindowTextW GetWindowPlacement GetForegroundWindow AttachThreadInput SetForegroundWindow BringWindowToTop GetDC ReleaseDC GetWindowLongPtrW SetWindowLongPtrW DefWindowProcW SetProcessDPIAware SubtractRect SetRect MapWindowPoints UnregisterClassW IntersectRect InflateRect IsRectEmpty PtInRect SetCursor ReleaseCapture SetCapture GetDlgItem InvalidateRect CreateWindowExW SetWindowLongW LoadCursorW SetRectEmpty GetClassLongW GetClassNameW GetClientRect RegisterWindowMessageW DrawTextW GetCursorPos

gdi32

CreateCompatibleBitmap SetWindowOrgEx ExcludeClipRect CreateSolidBrush LineTo ExtCreateRegion CombineRgn OffsetRgn SetTextColor SetBkMode CreateFontW CreateRectRgn CreateFontIndirectW GetDeviceCaps BitBlt DeleteDC CreateCompatibleDC CreateDIBSection DeleteObject SelectObject ExtTextOutW SetBkColor GetObjectW GetStockObject MoveToEx GetTextExtentPoint32W GetTextMetricsW

advapi32

RegCloseKey OpenProcessToken GetTokenInformation RegDeleteValueW RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW RegQueryValueExW RegOpenKeyExW

shell32

ShellExecuteW SHAppBarMessage

ole32

OleUninitialize CoInitialize OleInitialize CoCreateInstance CoUninitialize CoTaskMemRealloc CoTaskMemFree OleCreate OleSetContainedObject CoTaskMemAlloc

oleaut32

VariantInit VariantClear SysAllocString VarUI4FromStr SysFreeString

shlwapi

PathIsDirectoryW PathCanonicalizeW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

comctl32

_TrackMouseEvent

wininet

InternetWriteFile HttpSendRequestExW HttpSendRequestW InternetErrorDlg HttpQueryInfoW HttpOpenRequestA InternetConnectA InternetSetOptionW InternetOpenW InternetReadFile InternetCloseHandle HttpEndRequestW InternetQueryDataAvailable InternetQueryOptionW HttpAddRequestHeadersW InternetCrackUrlA

uxtheme

DrawThemeBackground OpenThemeData CloseThemeData

Name

.text

Size

694KB

Virtual Size

694KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ve_share

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_2c9ff68970bbd0efaa7098772d3d65af_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

comctl32

wininet

uxtheme

generic