2026-09-08_f6588e748fa779e3de8a9a57203f1111_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-09-08_f6588e748fa779e3de8a9a57203f1111_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.1MB
Sample260910-by969acl91
SHA256 e75ef84a914a09a55d20cd467a56f3beca7cb3c817dab968998c2f86c11f5e68
MD5 f6588e748fa779e3de8a9a57203f1111
SHA1 c75a705b0d12abc6e129cd756380dbd2ddcd80be
SHA512 23a6486d6f01b51ae1fb086f990661bf7fccf795bed3178ff2e405b4c1dff76414cfdc13e3f93ad933849ab7af360b233528912f07b7d113c30d1cd34408b247
SSDEEP 12288:5tzGdnB22qCg9YEfKmQJLYxRtph0lhSMXliNZX2Ecc:5tidnHNg23JCRPh0lhSMXlS9
TLSH
T1EC355A26BE5491A8D0F6D0B489C17412F6F3BC4A073067EB129076663E7F5E71AFAB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_f6588e748fa779e3de8a9a57203f1111_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-08_f6588e748fa779e3de8a9a57203f1111_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.1MB

2026-09-08_f6588e748fa779e3de8a9a57203f1111_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH f43fc687bda172388c2b79ac617dbce9
SHA256 e75ef84a914a09a55d20cd467a56f3beca7cb3c817dab968998c2f86c11f5e68
MD5 f6588e748fa779e3de8a9a57203f1111
SHA1 c75a705b0d12abc6e129cd756380dbd2ddcd80be
SHA512 23a6486d6f01b51ae1fb086f990661bf7fccf795bed3178ff2e405b4c1dff76414cfdc13e3f93ad933849ab7af360b233528912f07b7d113c30d1cd34408b247
SSDEEP 12288:5tzGdnB22qCg9YEfKmQJLYxRtph0lhSMXliNZX2Ecc:5tidnHNg23JCRPh0lhSMXlS9
TLSH
T1EC355A26BE5491A8D0F6D0B489C17412F6F3BC4A073067EB129076663E7F5E71AFAB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

331600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Litematic_V7_To_V6\Litematic_V7_To_V6\x64\Release\Litematic_V7_To_V6.pdb

kernel32

LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI CloseHandle GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW WaitForSingleObject GetExitCodeProcess CreateProcessW IsValidCodePage GetACP GetOEMCP HeapReAlloc GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile RtlUnwind

Name

.text

Size

488KB

Virtual Size

487KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

278KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

303KB

Virtual Size

302KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_f6588e748fa779e3de8a9a57203f1111_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

generic