Overview

overview

10

Static

static

3

2026-09-01...om.exe

windows10-2004-x64

10

2026-09-01...om.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-09-01_604594268e5ddae0c9216ba28012ff26_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
  • Size 16.8MB
  • Sample260903-m8a1pawane
  • SHA256 3cb748a1de46c90dd2a26c8944c4b831814994b5a7f8dc23b7921d70e06da026
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accesspersistenceprivilege_escalationpyinstallerransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\ProgramData\READ_ME_TO_DECRYPT.txt

Ransom Note
  • === YOUR FILES HAVE BEEN ENCRYPTED === All your important files, including programs, are now encrypted. To recover them, you can either pay in Bitcoin or redeem a gift card. Open the PAY HERE window on your desktop for payment instructions. You have 48 hours to pay. After that, the decryption key will be permanently destroyed. Do not attempt to modify or rename any encrypted files.

Targets

    • Target
      2026-09-01_604594268e5ddae0c9216ba28012ff26_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
    • Size 16.8MB
    • SHA256 3cb748a1de46c90dd2a26c8944c4b831814994b5a7f8dc23b7921d70e06da026
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accesspersistenceprivilege_escalationransomwarespywarestealer

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks