General
- Target 2026-09-04_1ef1ac0876c7e0abfdcd4be945795d0f_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 3.4MB
- Sample260905-vcbw4sydnh
- SHA256 c002398f13ca7c3a3bc3291db7f9f31f6763eed75753709650c1a568e083c16c
- MD5 1ef1ac0876c7e0abfdcd4be945795d0f
- SHA1 9883bcea0eac6484055f89c755a17a527aa43881
- SHA512 c1d899baa76701a19e14749a39183b36e3f41a0c010e898f28aa388d6247c517b625e80918f08289ac8cf41a2c83a9da60ddbba67cbef0eb0ce8b7632ee0c7c9
- SSDEEP 49152:H3LOYnEgr/Dg0OxtLmHeVpd8guGpUCwV/bfK5FljbsgYtq45f/NAcnYRusF:XoMGXvgKUdbfK5FljbsgUpVxQ3
- TLSH T19FF58D86A2EC00B8D167C178C5575E17E77E7C0813209BEB23E489662F63BE1563A71F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-04_1ef1ac0876c7e0abfdcd4be945795d0f_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-04_1ef1ac0876c7e0abfdcd4be945795d0f_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-04_1ef1ac0876c7e0abfdcd4be945795d0f_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
- Size 3.4MB
- SHA256 c002398f13ca7c3a3bc3291db7f9f31f6763eed75753709650c1a568e083c16c
- MD5 1ef1ac0876c7e0abfdcd4be945795d0f
- SHA1 9883bcea0eac6484055f89c755a17a527aa43881
- SHA512 c1d899baa76701a19e14749a39183b36e3f41a0c010e898f28aa388d6247c517b625e80918f08289ac8cf41a2c83a9da60ddbba67cbef0eb0ce8b7632ee0c7c9
- SSDEEP 49152:H3LOYnEgr/Dg0OxtLmHeVpd8guGpUCwV/bfK5FljbsgYtq45f/NAcnYRusF:XoMGXvgKUdbfK5FljbsgUpVxQ3
- TLSH T19FF58D86A2EC00B8D167C178C5575E17E77E7C0813209BEB23E489662F63BE1563A71F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables referencing many IR and analysis tools
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Server Software Component: Terminal Services DLL