General
- Target 2026-08-27_a971085e06801bef288ab51010f27e02_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom
- Size 7.2MB
- Sample260827-m2kasahc47
- SHA256 57cbc97ecd4a9a026576577c6227c6267bf2fedee24cde44cba805038fcb3b0b
- MD5 a971085e06801bef288ab51010f27e02
- SHA1 651cf5964e518e649bfca56dbceb428db624828c
- SHA512 5b6021400aea96ca7311edd96492aa3036c7410945916c5ea3e3448ccaa64fe8a10ca522d7e7b8167fc011a144332cace7a6528de50d096972e68d64f9d47ab3
- SSDEEP 196608:CzxZuZvEh4OPi48VtoKw6ILFwNflvvlb19j:COZvEh4OPWVuLFQtb1h
- TLSH T1E57633C8B5D101E9D5BB953888970C97EAE0BC470BE4A2CB07781AB62F237D55C36F52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_a971085e06801bef288ab51010f27e02_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-27_a971085e06801bef288ab51010f27e02_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-27_a971085e06801bef288ab51010f27e02_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom
- Size 7.2MB
- SHA256 57cbc97ecd4a9a026576577c6227c6267bf2fedee24cde44cba805038fcb3b0b
- MD5 a971085e06801bef288ab51010f27e02
- SHA1 651cf5964e518e649bfca56dbceb428db624828c
- SHA512 5b6021400aea96ca7311edd96492aa3036c7410945916c5ea3e3448ccaa64fe8a10ca522d7e7b8167fc011a144332cace7a6528de50d096972e68d64f9d47ab3
- SSDEEP 196608:CzxZuZvEh4OPi48VtoKw6ILFwNflvvlb19j:COZvEh4OPWVuLFQtb1h
- TLSH T1E57633C8B5D101E9D5BB953888970C97EAE0BC470BE4A2CB07781AB62F237D55C36F52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables Discord URL observed in first stage droppers
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.