5612b38ac8bdf17cd642addb5f73121ede0d5e91dda610cb9eab042b15ef9fc9

General

Target
2026-09-13_a678dd0ab2fe9df1c9cfef920658b721_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom
Size 6.2MB
Sample260913-nx3f8sysgt
SHA256 5612b38ac8bdf17cd642addb5f73121ede0d5e91dda610cb9eab042b15ef9fc9
MD5 a678dd0ab2fe9df1c9cfef920658b721
SHA1 31555bd0f31308e0153fdc068208306c0885ba8c
SHA512 89d8bbe9dbeb147282e9bb57073af200776930da9a960fca0b76ac80f047c5b0b9b8c48abbf35a1b48a9a93921f0685f06dd3c872e25f5d7091361fbbd34bc12
SSDEEP 98304:F9kmIzLieMOwfIT1M/6zIGWvPw6DHqah4X/wUEX/5zYvzPnKQ:F9k5VVwfIZj0Y6DKp/w9NY
TLSH
T10866330DB6B360FBD157A27DC5A3091A9456B81A232196D71162E9FD6F33AE0CF33720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-09-13_a678dd0ab2fe9df1c9cfef920658b721_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom
- Size 6.2MB
- SHA256 5612b38ac8bdf17cd642addb5f73121ede0d5e91dda610cb9eab042b15ef9fc9
- MD5 a678dd0ab2fe9df1c9cfef920658b721
- SHA1 31555bd0f31308e0153fdc068208306c0885ba8c
- SHA512 89d8bbe9dbeb147282e9bb57073af200776930da9a960fca0b76ac80f047c5b0b9b8c48abbf35a1b48a9a93921f0685f06dd3c872e25f5d7091361fbbd34bc12
- SSDEEP 98304:F9kmIzLieMOwfIT1M/6zIGWvPw6DHqah4X/wUEX/5zYvzPnKQ:F9k5VVwfIZj0Y6DKp/w9NY
- TLSH
  T10866330DB6B360FBD157A27DC5A3091A9456B81A232196D71162E9FD6F33AE0CF33720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

collection discovery execution persistence privilege_escalation spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing many email and collaboration clients. Observed in information steale
- Detects executables referencing many file transfer clients. Observed in information stealers
- Detects executables using Telegram Chat Bot
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2