2026-09-22_e33c63f2729780d7d11d033756ae877b_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-22_e33c63f2729780d7d11d033756ae877b_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_vidar
Size 20.2MB
Sample260922-3l24natgrd
SHA256 28ab45529c6f6b62054830c5857d5c6c80b4ffcecd4a2d962855c752f3056522
MD5 e33c63f2729780d7d11d033756ae877b
SHA1 826f6513db6b3d6329e7423894ea0433b1005470
SHA512 034a878dea91c638821d3ed1a7d1e7c36f4e0b8b2e52f18112acf57ca36dd5c48b40aaa9a410662d0dc20bc7a77e3c4bb2303e61fc416a6d9efb251d08187ed9
SSDEEP 393216:NJ3ZUg8e7yAr/JcCy3Xp84W/moR2hd1mrtvn5MRbRmOmD:NFZmcJIWl/mB/RbHm
TLSH
T1AF27D01AB66A18BDD8D6C4B4834B59238B20749B17716DEF43C496B52FAF7E00F39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-22_e33c63f2729780d7d11d033756ae877b_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_vidar

File Explorer

2026-09-22_e33c63f2729780d7d11d033756ae877b_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_vidar

.exe 20.2MB

2026-09-22_e33c63f2729780d7d11d033756ae877b_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_vidar

IMPHASH cfa075df1b68e52cbf4b9fdea6d9ab07
SHA256 28ab45529c6f6b62054830c5857d5c6c80b4ffcecd4a2d962855c752f3056522
MD5 e33c63f2729780d7d11d033756ae877b
SHA1 826f6513db6b3d6329e7423894ea0433b1005470
SHA512 034a878dea91c638821d3ed1a7d1e7c36f4e0b8b2e52f18112acf57ca36dd5c48b40aaa9a410662d0dc20bc7a77e3c4bb2303e61fc416a6d9efb251d08187ed9
SSDEEP 393216:NJ3ZUg8e7yAr/JcCy3Xp84W/moR2hd1mrtvn5MRbRmOmD:NFZmcJIWl/mB/RbHm
TLSH
T1AF27D01AB66A18BDD8D6C4B4834B59238B20749B17716DEF43C496B52FAF7E00F39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8602948

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared CloseHandle CompareStringW ConvertFiberToThread ConvertThreadToFiberEx CreateFiberEx CreateFileA CreateFileW CreateMutexA CreateMutexW CreatePipe CreateProcessA CreateSemaphoreA CreateThread DecodePointer DeleteCriticalSection DeleteFiber DeleteFileA DeleteFileW DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetActiveProcessorCount GetActiveProcessorGroupCount GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExA GetDriveTypeA GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameA GetFullPathNameW GetLargePageMinimum GetLastError GetLocaleInfoW GetLogicalDrives GetLogicalProcessorInformationEx GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemDirectoryW GetSystemFirmwareTable GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempFileNameA GetTempPathA GetTickCount64 GetTimeZoneInformation GetUserDefaultLCID GetVolumeInformationA GlobalMemoryStatusEx HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MoveFileExA MultiByteToWideChar PeekConsoleInputA PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleA ReadConsoleInputA ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCP SetConsoleCtrlHandler SetConsoleMode SetConsoleOutputCP SetEndOfFile SetEnvironmentVariableW SetErrorMode SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetThreadAffinityMask SetThreadDescription SetThreadGroupAffinity SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToFiber SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualAlloc VirtualAllocExNuma VirtualFree VirtualProtect WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

advapi32

AdjustTokenPrivileges CloseServiceHandle ControlService CreateServiceA CryptAcquireContextW CryptCreateHash CryptDecrypt CryptDestroyHash CryptDestroyKey CryptEnumProvidersW CryptExportKey CryptGenRandom CryptGetProvParam CryptGetUserKey CryptReleaseContext CryptSetHashParam CryptSignHashW DeleteService DeregisterEventSource LookupPrivilegeValueA LookupPrivilegeValueW OpenProcessToken OpenSCManagerA OpenServiceA RegCloseKey RegOpenKeyExA RegQueryValueExA RegisterEventSourceW ReportEventW StartServiceA

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW

powrprof

CallNtPowerInformation

ws2_32

WSACleanup WSAGetLastError WSASetLastError WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname getpeername getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa inet_pton ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt shutdown socket

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore CertOpenSystemStoreW

Name

.text

Size

8.4MB

Virtual Size

8.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11.4MB

Virtual Size

11.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

68KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

270KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_e33c63f2729780d7d11d033756ae877b_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_vidar

kernel32

advapi32

setupapi

powrprof

ws2_32

user32

crypt32

generic