2026-09-24_17ff4a594981b87c305508bc789cdda4_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_17ff4a594981b87c305508bc789cdda4_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 826KB
Sample260925-rmgcsszy2n
SHA256 b2a7175088f542d65dfadb123d7bde89f2a898f348f767f5dfafa5d4eafb11b1
MD5 17ff4a594981b87c305508bc789cdda4
SHA1 9be80e8b4bbf9e63a6d68105d916eff4d29eed71
SHA512 cf47c5860fcbb8cb5107d5e647aac5523e2b5142a02215a67cceb4ad77f03ea99252039da728c506aef8bca393fd1b8ee6acd0faf529a32401e2a417583f39af
SSDEEP 24576:i6gfeOFPFhDqEPvn8XQMOXTfIxzcZu0BMdmaDji3Z:i6gfPFPbZ3n8XQMOXTfIxzcZu0BMdmag
TLSH
T142056C5BB77801F9C17BD138D643A907E6B6740B43B05ADB13A043AA2F13AD4AE7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-24_17ff4a594981b87c305508bc789cdda4_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 826KB

2026-09-24_17ff4a594981b87c305508bc789cdda4_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 98126e3081397465310e896a9f4baf77
SHA256 b2a7175088f542d65dfadb123d7bde89f2a898f348f767f5dfafa5d4eafb11b1
MD5 17ff4a594981b87c305508bc789cdda4
SHA1 9be80e8b4bbf9e63a6d68105d916eff4d29eed71
SHA512 cf47c5860fcbb8cb5107d5e647aac5523e2b5142a02215a67cceb4ad77f03ea99252039da728c506aef8bca393fd1b8ee6acd0faf529a32401e2a417583f39af
SSDEEP 24576:i6gfeOFPFhDqEPvn8XQMOXTfIxzcZu0BMdmaDji3Z:i6gfPFPbZ3n8XQMOXTfIxzcZu0BMdmag
TLSH
T142056C5BB77801F9C17BD138D643A907E6B6740B43B05ADB13A043AA2F13AD4AE7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

29:8d:79:04:a3:0b:24:df:61:03:a2:78:c5:2f:c1:74:f6:34:e3:05:5c:cc:ac:86:b8:b9:7a:8c:7d:21:2c:8b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=5984112,CN=GoTo Technologies USA\, LLC,O=GoTo Technologies USA\, LLC,L=Boston,ST=Massachusetts,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 18, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:ad:3a:3f:fa:70:c0:a2:0a:e2:36:81:89:93:51:53

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 21, 2025 - Aug 22, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

360036

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\a\rescue-native-crashpad\rescue-native-crashpad\build\crashpad\out\x64-release-mt\crashpad_handler.pdb

kernel32

GetModuleHandleW GetProcAddress SetSearchPathMode SetUnhandledExceptionFilter SetProcessShutdownParameters SetConsoleCtrlHandler OutputDebugStringW GetLastError GetCurrentProcessId GetCurrentThreadId GetLocalTime FormatMessageW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetLastError GetModuleFileNameW DuplicateHandle ConnectNamedPipe DisconnectNamedPipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetEvent WaitForSingleObject CreateEventW GetCurrentProcess TerminateProcess CreateThread OpenProcess UnregisterWaitEx RegisterWaitForSingleObject GetFileInformationByHandleEx FindClose CloseHandle RemoveVectoredExceptionHandler LoadLibraryW CreateFileW SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW GetVersion ReleaseSemaphore CreateSemaphoreW GetStdHandle GetFileSizeEx GetFileType LockFileEx ReadFile SetEndOfFile SetFilePointerEx UnlockFileEx WriteFile FormatMessageA LocalFree CreateDirectoryW DeleteFileW GetFileAttributesW GetProcessTimes SuspendThread ResumeThread GetProcessId GetThreadContext Wow64GetThreadContext VerSetConditionMask IsProcessorFeaturePresent GetSystemInfo VerifyVersionInfoW GetTimeZoneInformation GetThreadLocale GetSystemDefaultLCID GetUserDefaultLCID IsWow64Process RaiseException AddVectoredExceptionHandler SleepEx Sleep CreateProcessW GetFullPathNameW WideCharToMultiByte InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RtlUnwindEx TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind GetCommandLineA GetCommandLineW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapReAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW GetFileTime RemoveDirectoryW VirtualQueryEx ReadProcessMemory InitializeCriticalSection VirtualQuery LoadLibraryExA GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetCurrentDirectoryW HeapQueryInformation

Name

.text

Size

570KB

Virtual Size

570KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

191KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_17ff4a594981b87c305508bc789cdda4_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

generic