2026-09-16_89734eda3fe38e824e47446af682f5c4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_89734eda3fe38e824e47446af682f5c4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 6.8MB
Sample260916-ya7sjsdc27
SHA256 24bc5b43d34849fa2e5bfe33632df71ec315d1a80c96382c5586f6d77cae0fd0
MD5 89734eda3fe38e824e47446af682f5c4
SHA1 3e21d12bc4ec1a52929a98a16f2a68df21948373
SHA512 d01a049ed5afa91c7a451e8d1f52f5d38101f329a5613fb9d589b35eeaae3a4ef6ebafa77d988b8dcd0f258f3f3b4203abe2367041c4722a9379f39329ab7a8c
SSDEEP 98304:Na4fKLrd1ypK534u/z7jrjcBxlvl/N9TjYvH:rfKIM4u/z7jrjcBt/N9v
TLSH
T108769E1E7A2E00E9C1BFD1798A47950BEAB17895033697CB66E18E550F13AF19F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_89734eda3fe38e824e47446af682f5c4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-09-16_89734eda3fe38e824e47446af682f5c4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 6.8MB

2026-09-16_89734eda3fe38e824e47446af682f5c4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 3033e9efd70b76f1b359c0fea41cd365
SHA256 24bc5b43d34849fa2e5bfe33632df71ec315d1a80c96382c5586f6d77cae0fd0
MD5 89734eda3fe38e824e47446af682f5c4
SHA1 3e21d12bc4ec1a52929a98a16f2a68df21948373
SHA512 d01a049ed5afa91c7a451e8d1f52f5d38101f329a5613fb9d589b35eeaae3a4ef6ebafa77d988b8dcd0f258f3f3b4203abe2367041c4722a9379f39329ab7a8c
SSDEEP 98304:Na4fKLrd1ypK534u/z7jrjcBxlvl/N9TjYvH:rfKIM4u/z7jrjcBt/N9v
TLSH
T108769E1E7A2E00E9C1BFD1798A47950BEAB17895033697CB66E18E550F13AF19F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1930816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\46b11e3b0e9c76c4\BUILDS\Release\x64\AvBugReport.pdb

winhttp

WinHttpQueryOption WinHttpSetOption WinHttpSetStatusCallback WinHttpAddRequestHeaders WinHttpSetCredentials WinHttpSendRequest WinHttpWriteData WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpOpenRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen WinHttpCloseHandle

bcrypt

BCryptExportKey BCryptGenerateSymmetricKey BCryptSecretAgreement BCryptDeriveKey BCryptImportKeyPair BCryptSetProperty BCryptOpenAlgorithmProvider BCryptDestroySecret BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptEncrypt BCryptGenRandom BCryptFinalizeKeyPair BCryptGenerateKeyPair

rpcrt4

RpcServerUseProtseqEpW RpcEpRegisterW RpcEpUnregister RpcBindingToStringBindingW RpcAsyncCompleteCall RpcAsyncInitializeHandle RpcAsyncCancelCall Ndr64AsyncClientCall NdrServerCallAll NdrServerCall2 NdrAsyncServerCall RpcObjectSetType RpcStringBindingParseW RpcServerRegisterIf2 RpcServerUnregisterIfEx RpcImpersonateClient RpcRevertToSelf I_RpcBindingInqLocalClientPID UuidCreate RpcStringBindingComposeW RpcBindingFromStringBindingW RpcStringFreeW RpcBindingFree NdrClientCall3 RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin UuidFromStringW UuidToStringW RpcMgmtEpEltInqDone RpcIfInqId Ndr64AsyncServerCallAll

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemory

shell32

SHGetKnownFolderPath ord165

ntdll

NtSystemDebugControl RtlLookupFunctionEntry RtlVirtualUnwind NtClose NtCreateWorkerFactory NtQueryInformationProcess NtQuerySystemInformation NtQueryInformationWorkerFactory RtlNtStatusToDosError VerSetConditionMask NtSetInformationThread NtOpenKey NtQueryKey NtDeleteKey RtlCaptureContext RtlDllShutdownInProgress RtlGetLastNtStatus RtlPcToFileHeader RtlUnwindEx RtlUnwind

kernel32

QueryFullProcessImageNameW GetPriorityClass OpenThread GetThreadPriority K32EnumProcesses OpenProcess GetThreadTimes GetModuleFileNameW K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessHandleCount CreateIoCompletionPort DeviceIoControl ReadProcessMemory TerminateProcess TlsFree TlsAlloc TlsSetValue TlsGetValue SetLastError GetNativeSystemInfo DuplicateHandle GetSystemTimes GetProcessTimes GetFileTime GetVersionExW LoadLibraryExW GetOverlappedResult PostQueuedCompletionStatus GetQueuedCompletionStatus WriteFile ReadFile CancelIoEx WaitForMultipleObjects GetTickCount64 VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileA CreateFileMappingW MapViewOfFile LockFileEx InitializeCriticalSectionEx HeapSize HeapReAlloc DecodePointer HeapDestroy CompareFileTime SetFilePointerEx UnlockFileEx GetFileSizeEx QueryUnbiasedInterruptTime UnregisterWaitEx ReadDirectoryChangesW ProcessIdToSessionId GetFileAttributesExW GetLocaleInfoW ResumeThread ResetEvent GetCurrentThread LocalFree TerminateThread SetThreadPriority InitializeCriticalSectionAndSpinCount QueryThreadCycleTime GetCurrentDirectoryW FindNextFileW WTSGetActiveConsoleSessionId DeleteProcThreadAttributeList K32GetProcessImageFileNameW GetThreadId CreatePipe SetHandleInformation LocalAlloc SetEvent FlushFileBuffers GetFileInformationByHandle GetFullPathNameW OutputDebugStringA FileTimeToSystemTime GetSystemInfo ExpandEnvironmentStringsW GetShortPathNameW GetSystemWindowsDirectoryW GetProcessAffinityMask GetLongPathNameW GlobalMemoryStatusEx GetDateFormatW GetTimeFormatW GetExitCodeThread GetDriveTypeW SetFilePointer SetFileAttributesW GetFileSize SetEndOfFile MoveFileExW GetWindowsDirectoryW CreateDirectoryW FindFirstFileExW QueryDosDeviceW GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetVersion CreateEventW LockResource LoadResource FindResourceExW FindResourceW CopyFileW SetFileInformationByHandle GetDiskFreeSpaceExW K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolWait WaitForThreadpoolWaitCallbacks SystemTimeToFileTime GetSystemTime LCMapStringEx EncodePointer WakeConditionVariable IsProcessorFeaturePresent CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared SleepConditionVariableSRW WakeAllConditionVariable GetLocaleInfoEx SwitchToThread WaitForSingleObjectEx GetFileInformationByHandleEx AreFileApisANSI Sleep IsDebuggerPresent OutputDebugStringW FindClose GetSystemTimeAsFileTime UpdateProcThreadAttribute InitializeProcThreadAttributeList DeleteFileW CreateFileW FindFirstFileW VerifyVersionInfoW GetExitCodeProcess CreateProcessW GetFileAttributesW FreeLibrary LoadLibraryW GetSystemDirectoryW DeleteCriticalSection InitializeCriticalSection CreateThread SetEnvironmentVariableW GetEnvironmentVariableW GetCurrentProcess GetProcessId GetCurrentProcessId DebugBreak FormatMessageW GetCurrentThreadId GetModuleHandleExW GetModuleFileNameA GlobalFree GetProcessHeap HeapAlloc HeapFree EnterCriticalSection LeaveCriticalSection CompareStringW SetErrorMode MultiByteToWideChar SetDllDirectoryW GetConsoleWindow CloseHandle ReleaseMutex WaitForSingleObject GetLastError CreateMutexW GetModuleHandleW GetProcAddress WideCharToMultiByte WriteConsoleW RegisterWaitForSingleObject GetSystemDirectoryA GetModuleHandleA LoadLibraryA SleepEx MoveFileExA GetEnvironmentVariableA CompareStringEx GetCPInfo InitializeSListHead UnhandledExceptionFilter GetStartupInfoW InterlockedPushEntrySList ExitThread FreeLibraryAndExitThread GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime GetConsoleMode HeapQueryInformation GetTimeZoneInformation FreeEnvironmentStringsW GetEnvironmentStringsW GetStringTypeW InitOnceComplete InitOnceBeginInitialize FormatMessageA EnumSystemLocalesW IsValidCodePage ReadConsoleW GetConsoleOutputCP GetStdHandle GetCommandLineA GetCommandLineW ExitProcess SetStdHandle FlsAlloc FlsGetValue GetTickCount VirtualQuery RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter RaiseException FlushInstructionCache VirtualProtect SizeofResource FlsSetValue CheckRemoteDebuggerPresent FlsFree GetOEMCP GetACP LCMapStringW IsValidLocale GetUserDefaultLCID

user32

RegisterClassExW GetClassInfoExW EnumWindows GetWindowThreadProcessId SetWindowLongPtrW SendMessageW PostMessageW RegisterWindowMessageW LoadStringW GetSystemMetrics GetGUIThreadInfo SendMessageCallbackW IsHungAppWindow PeekMessageW ShowWindow WaitForInputIdle

advapi32

EventWriteTransfer SetSecurityDescriptorDacl RevertToSelf RegCloseKey CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus EventRegister EventUnregister RegCreateKeyExW RegQueryValueExW OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation OpenProcessToken EqualSid ImpersonateLoggedOnUser ImpersonateSelf CryptDestroyHash DuplicateTokenEx LookupAccountSidW CryptReleaseContext CryptGenRandom CryptAcquireContextW CryptHashData CryptCreateHash CryptGetHashParam CryptAcquireContextA RegDeleteTreeW RegDeleteKeyExW RegNotifyChangeKeyValue EnumServicesStatusW QueryServiceStatusEx QueryServiceConfigW RegQueryMultipleValuesW RegQueryInfoKeyW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegSetValueExW FreeSid RegOpenKeyExW AddAce InitializeAcl GetLengthSid AllocateAndInitializeSid ConvertSecurityDescriptorToStringSecurityDescriptorW GetFileSecurityW AdjustTokenPrivileges LookupPrivilegeValueW CheckTokenMembership DuplicateToken InitializeSecurityDescriptor

ole32

CoInitializeEx CoCreateInstance CoUninitialize CoCreateGuid CLSIDFromString CoTaskMemFree StringFromGUID2

powrprof

CallNtPowerInformation

shlwapi

PathAppendW PathMatchSpecW

fltlib

FilterConnectCommunicationPort FilterLoad FilterGetMessage FilterReplyMessage FilterSendMessage

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiOpenDevRegKey SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertFreeCTLContext CertAddCertificateContextToStore CertFreeCRLContext CertFreeCertificateContext PFXImportCertStore CryptStringToBinaryA CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptDecodeObjectEx

oleaut32

SysFreeString VariantInit VariantClear

iphlpapi

if_nametoindex GetAdaptersAddresses Icmp6SendEcho2 Icmp6CreateFile IcmpSendEcho IcmpCreateFile IcmpCloseHandle GetNetworkParams

ws2_32

WSAWaitForMultipleEvents WSAResetEvent WSAStartup freeaddrinfo getaddrinfo WSAEventSelect ioctlsocket WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getsockopt WSAAddressToStringW ntohl WSASetLastError GetAddrInfoW FreeAddrInfoW ntohs getsockname bind htonl recvfrom select sendto connect htons WSAGetLastError socket send closesocket FreeAddrInfoExW recv setsockopt WSAIoctl __WSAFDIsSet GetAddrInfoExW WSACleanup

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

502KB

Virtual Size

542KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

206KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

600KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=224, id=261, version=33138,

count=11, id=259, version=33138,

count=4, id=253, version=34321,

count=19, id=260, version=34321,

count=12, id=259, version=34321,

count=123, id=261, version=34321,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=20, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=118, id=260, version=30154,

count=7, id=260, version=32545,

count=13, productName=Unmarked objects (old),

count=45, id=261, version=32545,

count=9, id=261, version=33520,

count=41, id=260, version=33138,

count=43, id=257, version=33138,

count=648, id=1, productName=Unmarked objects,

count=427, id=265, version=34436,

count=1, id=256, version=34436,

count=1, id=255, version=34436,

count=2, id=151,

count=1, id=258, version=34436,