General
- Target 2026-09-13_96e490087bd8b55db12eabacebe8209d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 10.1MB
- Sample260913-pjmdjabb34
- SHA256 96295f593841864471596ccf57ac69774fb1311ec31ff17acb0be65bbd3e1e68
- MD5 96e490087bd8b55db12eabacebe8209d
- SHA1 6531b33e307ff68ef51a65c475142cd3230b004c
- SHA512 a720b7c62c5c8a870a6f1f118588d1659962ba75b5a505d7c3c99bd8fd5fd53772f6630b85453b1e0eef04c54de53aee83247a001290a2298fa75314ad3a349e
- SSDEEP 196608:Ua85DbJrten1kb5Rb2ILjR2vfZ1W903eV4QRM993iObMAR1jQmGYuuLmonX1P8F3:N85vzc2F1rnR2vffW+eGQRe93iObLRSK
- TLSH T18DB6334A93FA4DF2EC73467A81E3C048EB31796B03B8D5C787A546512E273D2593EE60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-09-13_96e490087bd8b55db12eabacebe8209d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-13_96e490087bd8b55db12eabacebe8209d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-13_96e490087bd8b55db12eabacebe8209d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 10.1MB
- SHA256 96295f593841864471596ccf57ac69774fb1311ec31ff17acb0be65bbd3e1e68
- MD5 96e490087bd8b55db12eabacebe8209d
- SHA1 6531b33e307ff68ef51a65c475142cd3230b004c
- SHA512 a720b7c62c5c8a870a6f1f118588d1659962ba75b5a505d7c3c99bd8fd5fd53772f6630b85453b1e0eef04c54de53aee83247a001290a2298fa75314ad3a349e
- SSDEEP 196608:Ua85DbJrten1kb5Rb2ILjR2vfZ1W903eV4QRM993iObMAR1jQmGYuuLmonX1P8F3:N85vzc2F1rnR2vffW+eGQRe93iObLRSK
- TLSH T18DB6334A93FA4DF2EC73467A81E3C048EB31796B03B8D5C787A546512E273D2593EE60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.