General
- Target 2026-09-06_72f20287c3e54c2d03fb2d0516acb3ed_blankgrabber_cobalt-strike_icedid_njrat_satacom
- Size 13.4MB
- Sample260907-a949pswbkc
- SHA256 bfb3c7507a92312bb902b7f11ab726e5c812026fc261f1bbb389e19fa0bbf8b3
- MD5 72f20287c3e54c2d03fb2d0516acb3ed
- SHA1 38e3f86626f21259693a131d6cf3ac4cbff0ebf1
- SHA512 d42af3dc4c56ae994ed5a7d596e2b92908018728fd1a101f93f955c29e0ba2dd7a982a67bb512fe78e655a368738411f637da82bac7dbb487c4976794999d3d0
- SSDEEP 393216:vdvFOmGR96MOo27X0NhOHavY8pUJqzT+57ZsE4:VFO1Wvb0TOHvLJqX+57ZsV
- TLSH T1BFE63320A88250F7C3439A7AC2E377F245FDBFA22F4659B32321BDD93C215E85519927
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-06_72f20287c3e54c2d03fb2d0516acb3ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-06_72f20287c3e54c2d03fb2d0516acb3ed_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260710-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-06_72f20287c3e54c2d03fb2d0516acb3ed_blankgrabber_cobalt-strike_icedid_njrat_satacom
- Size 13.4MB
- SHA256 bfb3c7507a92312bb902b7f11ab726e5c812026fc261f1bbb389e19fa0bbf8b3
- MD5 72f20287c3e54c2d03fb2d0516acb3ed
- SHA1 38e3f86626f21259693a131d6cf3ac4cbff0ebf1
- SHA512 d42af3dc4c56ae994ed5a7d596e2b92908018728fd1a101f93f955c29e0ba2dd7a982a67bb512fe78e655a368738411f637da82bac7dbb487c4976794999d3d0
- SSDEEP 393216:vdvFOmGR96MOo27X0NhOHavY8pUJqzT+57ZsE4:VFO1Wvb0TOHvLJqX+57ZsV
- TLSH T1BFE63320A88250F7C3439A7AC2E377F245FDBFA22F4659B32321BDD93C215E85519927
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Loads dropped DLL
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.