General
- Target 2026-09-04_2cb3dcb805670ad5b2b33732fbdf35d1_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 28.6MB
- Sample260905-svygqaef35
- SHA256 24545471e258d30541b60c65b9c1e72abdee6d05f444f4d720589d967d12dc02
- MD5 2cb3dcb805670ad5b2b33732fbdf35d1
- SHA1 2f130bcc52713a87d9a6bbbdc3a42472cff46616
- SHA512 badacf86586b12fae9108a506c78b4485b5b05eed6253b234c7fc1abb7b9d20a67adae655b9745ea434a642254da278fc5c87d7dc996980aab40cc538114d48e
- SSDEEP 786432:fbS4ce2s7X3RphzXahpHJXduJT+I10MABEaj8vsr5W8w7:W4f/DPhzXahk303GK5W8w7
- TLSH T1A5673359767050BBE9D0853A5EEFC4E2F3A225168365C3AF17AC1B351D7B2B02D38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-09-04_2cb3dcb805670ad5b2b33732fbdf35d1_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-04_2cb3dcb805670ad5b2b33732fbdf35d1_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-04_2cb3dcb805670ad5b2b33732fbdf35d1_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 28.6MB
- SHA256 24545471e258d30541b60c65b9c1e72abdee6d05f444f4d720589d967d12dc02
- MD5 2cb3dcb805670ad5b2b33732fbdf35d1
- SHA1 2f130bcc52713a87d9a6bbbdc3a42472cff46616
- SHA512 badacf86586b12fae9108a506c78b4485b5b05eed6253b234c7fc1abb7b9d20a67adae655b9745ea434a642254da278fc5c87d7dc996980aab40cc538114d48e
- SSDEEP 786432:fbS4ce2s7X3RphzXahpHJXduJT+I10MABEaj8vsr5W8w7:W4f/DPhzXahk303GK5W8w7
- TLSH T1A5673359767050BBE9D0853A5EEFC4E2F3A225168365C3AF17AC1B351D7B2B02D38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.