General
- Target 2026-08-31_f5b4407bbd8c4e570f43de0e49ed3c8d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 19.5MB
- Sample260901-3ckg9attet
- SHA256 6c25eded688be85fe084fe801afdca6c3229b09b794f3bff3bb045b0833cc4f4
- MD5 f5b4407bbd8c4e570f43de0e49ed3c8d
- SHA1 c41f44a42b3a88a2590e40ae52723dcaa673b10d
- SHA512 ecdb52ce913827ac6b03475e46ee8f908a17ac18b94056389a00c49a1f5df04d0fc2085316a2fdc650ebfb002107417846b94b280787a31e9266557d86d89e96
- SSDEEP 393216:ZOKPvzSs7dq5WRR+I/yr76hdZvdQJliwF3MnG3/lAWPo37bpquR8ucx/2fvR:8KPvzZBEARfa7KZvdQ33MGVPorFgUv
- TLSH T156273317635918E2EED66A3A40A3D1785A20FE665770DECF0BD03D7378876D01A3EE24
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-31_f5b4407bbd8c4e570f43de0e49ed3c8d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-31_f5b4407bbd8c4e570f43de0e49ed3c8d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-31_f5b4407bbd8c4e570f43de0e49ed3c8d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 19.5MB
- SHA256 6c25eded688be85fe084fe801afdca6c3229b09b794f3bff3bb045b0833cc4f4
- MD5 f5b4407bbd8c4e570f43de0e49ed3c8d
- SHA1 c41f44a42b3a88a2590e40ae52723dcaa673b10d
- SHA512 ecdb52ce913827ac6b03475e46ee8f908a17ac18b94056389a00c49a1f5df04d0fc2085316a2fdc650ebfb002107417846b94b280787a31e9266557d86d89e96
- SSDEEP 393216:ZOKPvzSs7dq5WRR+I/yr76hdZvdQJliwF3MnG3/lAWPo37bpquR8ucx/2fvR:8KPvzZBEARfa7KZvdQ33MGVPorFgUv
- TLSH T156273317635918E2EED66A3A40A3D1785A20FE665770DECF0BD03D7378876D01A3EE24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.