2026-09-16_9bc9f730f8e9ed4b8f0aea189108371b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_poet-rat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_9bc9f730f8e9ed4b8f0aea189108371b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_poet-rat_ryuk
Size 37.9MB
Sample260916-xjsvbasyfx
SHA256 05d1651bb0e2fc5a071ac347c988a2385fc725d9eaa4f527189f0afdf59e0d40
MD5 9bc9f730f8e9ed4b8f0aea189108371b
SHA1 7a480264a970c4ee5d30c9ed315b12368989c114
SHA512 cbdadf5ccb52d4d7f6f520002bee67b52b2e49c7cc675b7e7ca746ac8e0d188c5242fc61e9cd6b5537d90e109cc28339c1751507a5a66195e043033e671fefd4
SSDEEP 393216:lgB3c2xFi3Iskv+tlx64SNAKFdu9CwJsv6ttvsQP4kd7Voh:UN5gls4SKkQP4kd7Vo
TLSH
T118977B1762F501C5E1BBC138CBB68123EB71788517749ADF225462692F33BF06E7A326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_9bc9f730f8e9ed4b8f0aea189108371b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_poet-rat_ryuk

File Explorer

2026-09-16_9bc9f730f8e9ed4b8f0aea189108371b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_poet-rat_ryuk

.exe 37.9MB

2026-09-16_9bc9f730f8e9ed4b8f0aea189108371b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_poet-rat_ryuk

IMPHASH 8ed055821baa32882536b8f44d363d08
SHA256 05d1651bb0e2fc5a071ac347c988a2385fc725d9eaa4f527189f0afdf59e0d40
MD5 9bc9f730f8e9ed4b8f0aea189108371b
SHA1 7a480264a970c4ee5d30c9ed315b12368989c114
SHA512 cbdadf5ccb52d4d7f6f520002bee67b52b2e49c7cc675b7e7ca746ac8e0d188c5242fc61e9cd6b5537d90e109cc28339c1751507a5a66195e043033e671fefd4
SSDEEP 393216:lgB3c2xFi3Iskv+tlx64SNAKFdu9CwJsv6ttvsQP4kd7Voh:UN5gls4SKkQP4kd7Vo
TLSH
T118977B1762F501C5E1BBC138CBB68123EB71788517749ADF225462692F33BF06E7A326
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21491200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptEnumContextFunctions BCryptFreeBuffer BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

ncrypt

NCryptCreatePersistedKey NCryptExportKey NCryptFinalizeKey NCryptFreeObject NCryptImportKey NCryptOpenKey NCryptOpenStorageProvider NCryptSetProperty NCryptSignHash

iphlpapi

ConvertInterfaceIndexToLuid ConvertInterfaceLuidToIndex ConvertInterfaceLuidToNameW ConvertInterfaceNameToLuidW GetAdaptersAddresses GetIfEntry2

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceInterfaceDetailW SetupDiGetDeviceRegistryPropertyW SetupDiOpenDevRegKey SetupDiOpenDeviceInterfaceW

advapi32

AddAccessAllowedAceEx AddAccessDeniedAceEx AllocateAndInitializeSid CopySid CredDeleteW CredFree CredReadW CredWriteW DuplicateToken FreeSid GetLengthSid GetNamedSecurityInfoW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetUserNameW InitializeAcl InitializeSecurityDescriptor LookupAccountNameW LookupAccountSidW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegGetValueW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SystemFunction036

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AllocConsole AttachConsole CancelIoEx CheckRemoteDebuggerPresent CloseHandle CloseThreadpoolWait CompareStringEx CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateMutexA CreateNamedPipeW CreateProcessW CreateThread CreateThreadpoolWait DecodePointer DeleteCriticalSection DeleteFileW DeviceIoControl DisconnectNamedPipe EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindCloseChangeNotification FindFirstChangeNotificationW FindFirstFileExW FindFirstFileW FindNextChangeNotification FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeConsole FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrencyFormatW GetCurrentDirectoryW GetCurrentPackageFullName GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileType GetFullPathNameW GetGeoInfoW GetLastError GetLocalTime GetLocaleInfoW GetLogicalDrives GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemFirmwareTable GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadPriority GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetUserGeoID GetUserPreferredUILanguages GetVolumeInformationW GetVolumeNameForVolumeMountPointW GetVolumePathNameW GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetModuleFileNameExW LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LocaleNameToLCID MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlDeleteFunctionTable RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetErrorMode SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetLastError SetStdHandle SetThreadDescription SetThreadInformation SetThreadPriority SetThreadpoolWait SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToFileTime TerminateProcess TerminateThread TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WTSGetActiveConsoleSessionId WaitForMultipleObjects WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WaitForThreadpoolWaitCallbacks WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

shell32

CommandLineToArgvW SHBrowseForFolderW SHCreateItemFromIDList SHCreateItemFromParsingName ord6 SHGetFileInfoW ord727 SHGetKnownFolderIDList SHGetKnownFolderPath SHGetMalloc SHGetPathFromIDListW SHGetStockIconInfo ShellExecuteExW ShellExecuteW Shell_NotifyIconGetRect Shell_NotifyIconW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

AddClipboardFormatListener AdjustWindowRectEx AdjustWindowRectExForDpi AppendMenuW AreDpiAwarenessContextsEqual AttachThreadInput BeginPaint BringWindowToTop ChangeClipboardChain ChangeWindowMessageFilter ChangeWindowMessageFilterEx CharPrevExA ChildWindowFromPointEx ClientToScreen CreateCaret CreateCursor CreateIconIndirect CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DestroyCaret DestroyCursor DestroyIcon DestroyMenu DestroyWindow DispatchMessageW DisplayConfigGetDeviceInfo DrawIconEx DrawMenuBar EnableMenuItem EnableNonClientDpiScaling EndPaint EnumDisplayMonitors EnumWindows FindWindowA FlashWindowEx GetAncestor GetAsyncKeyState GetCapture GetCaretBlinkTime GetClassInfoW GetClientRect GetClipboardFormatNameW GetCursor GetCursorInfo GetCursorPos GetDC GetDesktopWindow GetDisplayConfigBufferSizes GetDoubleClickTime GetDpiForWindow GetFocus GetForegroundWindow GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetMenu GetMenuItemInfoW GetMessageExtraInfo GetMessageTime GetMessageW GetMonitorInfoW GetParent GetPointerDeviceRects GetPointerFrameTouchInfo GetPointerFrameTouchInfoHistory GetPointerInfo GetPointerPenInfo GetPointerPenInfoHistory GetPointerType GetQueueStatus GetSysColor GetSystemMenu GetSystemMetrics GetSystemMetricsForDpi GetThreadDpiAwarenessContext GetUpdateRect GetWindow GetWindowDpiAwarenessContext GetWindowLongPtrW GetWindowPlacement GetWindowRect GetWindowThreadProcessId HiliteMenuItem InsertMenuW InvalidateRect IsChild IsHungAppWindow IsIconic IsTouchWindow IsValidDpiAwarenessContext IsWindow IsWindowEnabled IsWindowVisible IsZoomed KillTimer LoadCursorW LoadIconW LoadImageW MapVirtualKeyW MapWindowPoints MessageBeep MessageBoxW ModifyMenuW MonitorFromPoint MonitorFromRect MonitorFromWindow MoveWindow MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostThreadMessageW QueryDisplayConfig RegisterClassExW RegisterClassW RegisterClipboardFormatW RegisterDeviceNotificationW RegisterPowerSettingNotification RegisterTouchWindow RegisterWindowMessageW ReleaseCapture ReleaseDC RemoveClipboardFormatListener RemoveMenu ScreenToClient SendInput SendMessageTimeoutW SendMessageW SetActiveWindow SetCapture SetCaretPos SetClipboardViewer SetCoalescableTimer SetCursor SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetMenu SetMenuDefaultItem SetMenuItemInfoW SetParent SetProcessDpiAwarenessContext SetTimer SetWindowLongPtrW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW ShowCaret ShowWindow SkipPointerFrameMessages SystemParametersInfoForDpi SystemParametersInfoW ToAscii ToUnicode TrackMouseEvent TrackPopupMenu TrackPopupMenuEx TranslateMessage UnregisterClassW UnregisterDeviceNotification UnregisterPowerSettingNotification UnregisterTouchWindow UpdateLayeredWindow UpdateLayeredWindowIndirect WindowFromPoint

icuuc

UCNV_FROM_U_CALLBACK_SUBSTITUTE UCNV_TO_U_CALLBACK_SUBSTITUTE ucnv_cbFromUWriteUChars ucnv_cbToUWriteUChars ucnv_close ucnv_fromUCountPending ucnv_fromUnicode ucnv_getFromUCallBack ucnv_getMaxCharSize ucnv_getName ucnv_getStandardName ucnv_getToUCallBack ucnv_open ucnv_reset ucnv_setFromUCallBack ucnv_setToUCallBack ucnv_toUCountPending ucnv_toUnicode

ole32

CoCreateFreeThreadedMarshaler CoCreateGuid CoCreateInstance CoGetMalloc CoInitializeEx CoLockObjectExternal CoTaskMemFree CoUninitialize DoDragDrop OleFlushClipboard OleGetClipboard OleInitialize OleIsCurrentClipboard OleSetClipboard OleUninitialize RegisterDragDrop ReleaseStgMedium RevokeDragDrop

netapi32

NetApiBufferFree NetShareEnum

authz

AuthzAccessCheck AuthzFreeContext AuthzFreeResourceManager AuthzInitializeContextFromSid AuthzInitializeContextFromToken AuthzInitializeResourceManager

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

PlaySoundW timeKillEvent timeSetEvent

ws2_32

WSAAccept WSAAsyncSelect WSACleanup WSAConnect WSAGetLastError WSAHtonl WSAIoctl WSANtohl WSANtohs WSARecv WSARecvFrom WSASend WSASendTo WSASocketW WSAStartup __WSAFDIsSet bind closesocket freeaddrinfo getaddrinfo getnameinfo getpeername getsockname getsockopt htonl htons listen ntohl select setsockopt

secur32

AcceptSecurityContext AcquireCredentialsHandleW ApplyControlToken DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitSecurityInterfaceW InitializeSecurityContextW QueryContextAttributesW

oleaut32

GetErrorInfo SafeArrayCreateVector SafeArrayPutElement SetErrorInfo SysAllocString SysFreeString SysStringLen VariantClear VariantInit

crypt32

CertAddStoreToCollection CertCloseStore CertCompareCertificate CertDuplicateCertificateContext CertFindCertificateInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty CertOpenStore CertSetCertificateContextProperty CertVerifyTimeValidity CryptAcquireCertificatePrivateKey CryptEncodeObject PFXImportCertStore

gdi32

AddFontMemResourceEx AddFontResourceExW BitBlt CombineRgn CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateFontIndirectW CreateRectRgn DeleteDC DeleteObject EnumFontFamiliesExW ExtTextOutW GdiFlush GetBitmapBits GetCharABCWidthsFloatW GetCharABCWidthsI GetCharABCWidthsW GetCharWidthI GetDIBits GetDeviceCaps GetFontData GetGlyphOutlineW GetObjectW GetOutlineTextMetricsW GetRegionData GetStockObject GetTextExtentPoint32W GetTextFaceW GetTextMetricsW OffsetRgn RemoveFontMemResourceEx RemoveFontResourceExW SelectObject SetBkMode SetGraphicsMode SetLayout SetTextAlign SetTextColor SetWorldTransform

winhttp

WinHttpCloseHandle WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen

uxtheme

CloseThemeData ord47 GetThemeBackgroundRegion GetThemeBool GetThemeColor GetThemeEnumValue GetThemeInt GetThemeMargins GetThemePartSize GetThemePropertyOrigin IsAppThemed IsThemeActive IsThemeBackgroundPartiallyTransparent OpenThemeData SetWindowTheme

dwrite

DWriteCreateFactory

ntdll

NtQueryKey

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

dwmapi

DwmEnableBlurBehindWindow DwmExtendFrameIntoClientArea DwmSetWindowAttribute

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

shlwapi

AssocQueryStringW

imm32

ImmAssociateContext ImmAssociateContextEx ImmGetCompositionStringW ImmGetContext ImmGetDefaultIMEWnd ImmGetOpenStatus ImmGetVirtualKey ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

uiautomationcore

UiaClientsAreListening UiaHostProviderFromHwnd UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaRaiseNotificationEvent UiaReturnRawElementProvider

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

d3d12

ord101 ord102 D3D12SerializeVersionedRootSignature

comdlg32

GetOpenFileNameW GetSaveFileNameW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

20.8MB

Virtual Size

20.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14.6MB

Virtual Size

14.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.0MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.qtmimed

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

697B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

227KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_9bc9f730f8e9ed4b8f0aea189108371b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_poet-rat_ryuk

bcrypt

ncrypt

iphlpapi

setupapi

advapi32

kernel32

shell32

api-ms-win-core-synch-l1-2-0

user32

icuuc

ole32

netapi32

authz

userenv

version

winmm

ws2_32

secur32

oleaut32

crypt32

gdi32

winhttp

uxtheme

dwrite

ntdll

wtsapi32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

dwmapi

api-ms-win-shcore-scaling-l1-1-1

shlwapi

imm32

uiautomationcore

d3d11

dxgi

d3d12

comdlg32

api-ms-win-core-winrt-error-l1-1-1

generic