General
- Target 2026-08-24_f859a692b79bdcfd8f805c0e49cfefb3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 31.8MB
- Sample260824-ya3tlasfqd
- SHA256 627c65afe8aaa38b9bb05bd28a25edb2da3fb991a835a6d91a3eff213c184a2c
- MD5 f859a692b79bdcfd8f805c0e49cfefb3
- SHA1 6be99e3bfdd584335503f6a8c5d37b8853ce7847
- SHA512 507eee349f4d1f5dae74c42152a4f5d0ecbcf46cb8c1919e58382af50c5c9a517b118751aeb229a03a8acf165f1ccf524e4648caa65cdfa8477e576e86828c5b
- SSDEEP 786432:Z21nbhVEHCYFqJoZIHLOSvCIo2PBD+gEwLKbua0LhXUyvvTUh:I1pouHKUCf+BDO0muBLlG
- TLSH T1287733B662DA88F6FCA340344A1245D0B737BCDA9B20DA9E06E40A635D771F438395F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-08-24_f859a692b79bdcfd8f805c0e49cfefb3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_f859a692b79bdcfd8f805c0e49cfefb3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-24_f859a692b79bdcfd8f805c0e49cfefb3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 31.8MB
- SHA256 627c65afe8aaa38b9bb05bd28a25edb2da3fb991a835a6d91a3eff213c184a2c
- MD5 f859a692b79bdcfd8f805c0e49cfefb3
- SHA1 6be99e3bfdd584335503f6a8c5d37b8853ce7847
- SHA512 507eee349f4d1f5dae74c42152a4f5d0ecbcf46cb8c1919e58382af50c5c9a517b118751aeb229a03a8acf165f1ccf524e4648caa65cdfa8477e576e86828c5b
- SSDEEP 786432:Z21nbhVEHCYFqJoZIHLOSvCIo2PBD+gEwLKbua0LhXUyvvTUh:I1pouHKUCf+BDO0muBLlG
- TLSH T1287733B662DA88F6FCA340344A1245D0B737BCDA9B20DA9E06E40A635D771F438395F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.