General
- Target 2026-08-24_50791f1ee134054892a6f213bb6d0645_blankgrabber_cobalt-strike_icedid_njrat_satacom
- Size 11.2MB
- Sample260825-qrda9san71
- SHA256 91578165ae6f07c4f2d3cff04c24dc325bcb962f5896092a9b3128a269a46ae9
Score
9/10
Malware Config
Targets
-
- Target 2026-08-24_50791f1ee134054892a6f213bb6d0645_blankgrabber_cobalt-strike_icedid_njrat_satacom
- Size 11.2MB
- SHA256 91578165ae6f07c4f2d3cff04c24dc325bcb962f5896092a9b3128a269a46ae9
Score9/10-
Detects executables (downlaoders) containing URLs to raw contents of a paste
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.