2026-09-27_748e97c8645aa117dff967e1c7ece0d4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-27_748e97c8645aa117dff967e1c7ece0d4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 1.8MB
Sample260928-e6vnbavt2r
SHA256 2e56d9fcb8f66d6747da7d9e76485ae26bb78d4d8a1b7702383f7e13384bd79a
MD5 748e97c8645aa117dff967e1c7ece0d4
SHA1 c6baf3ac8dce484fe17315412d43cd4cd47c6804
SHA512 7d933117f589fa4dc89cbe5f6411092d42f58bd5e89f9ed2aadcdedb66a32764e70c37b09ada9e35e57c74efc3db4dab5232a77ec9e9a14d37cc5b147767423d
SSDEEP 49152:QmikO9u0pWPbLOIqUcZmbkBz2qYXB+kn3Hnx:QiQ2FR+k
TLSH
T14D95C065BAA501E8D5B7D134C78662A7EAF1B42017347EEF0D589A212F33EE1133E709
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-27_748e97c8645aa117dff967e1c7ece0d4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-09-27_748e97c8645aa117dff967e1c7ece0d4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

.exe 1.8MB

2026-09-27_748e97c8645aa117dff967e1c7ece0d4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 63cb8ec8518342811d9458243e6e5fe6
SHA256 2e56d9fcb8f66d6747da7d9e76485ae26bb78d4d8a1b7702383f7e13384bd79a
MD5 748e97c8645aa117dff967e1c7ece0d4
SHA1 c6baf3ac8dce484fe17315412d43cd4cd47c6804
SHA512 7d933117f589fa4dc89cbe5f6411092d42f58bd5e89f9ed2aadcdedb66a32764e70c37b09ada9e35e57c74efc3db4dab5232a77ec9e9a14d37cc5b147767423d
SSDEEP 49152:QmikO9u0pWPbLOIqUcZmbkBz2qYXB+kn3Hnx:QiQ2FR+k
TLSH
T14D95C065BAA501E8D5B7D134C78662A7EAF1B42017347EEF0D589A212F33EE1133E709
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

755728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

sshd.pdb

libcrypto

DSA_new DSA_SIG_new DSA_set0_pqg AES_set_encrypt_key DSA_set0_key AES_encrypt DSA_do_verify DSA_get0_pqg DSA_generate_key DSA_generate_parameters_ex DSA_SIG_free BN_dup RSA_generate_key_ex BN_set_flags explicit_bzero RSA_new RSA_set0_crt_params RSA_free BN_free BN_set_word DSA_get0_key BN_div RSA_set0_factors RSA_size RSA_get0_factors RSA_get0_crt_params RSA_set0_key BN_CTX_new BN_CTX_free ECDSA_do_sign EC_POINT_cmp EC_KEY_set_private_key EC_KEY_generate_key ECDSA_SIG_get0 ECDSA_SIG_free DSA_do_sign ECDSA_SIG_set0 DSA_free EC_KEY_set_asn1_flag ECDSA_do_verify EC_KEY_new_by_curve_name ECDSA_SIG_new RAND_status OpenSSL_version_num EC_KEY_free EVP_CIPHER_CTX_key_length EVP_CIPHER_CTX_new EVP_aes_256_cbc EVP_CIPHER_CTX_iv_length EVP_CipherInit EVP_aes_128_ctr EVP_aes_256_ctr EVP_CIPHER_CTX_get_iv EVP_des_ede3_cbc EVP_aes_192_cbc EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_set_key_length EVP_aes_192_ctr EVP_Cipher EVP_aes_256_gcm EVP_aes_128_gcm EVP_CIPHER_CTX_free DSA_SIG_set0 DH_size DH_compute_key EC_POINT_oct2point DSA_SIG_get0 BN_bn2bin EC_POINT_clear_free EC_GROUP_get_degree RSA_sign ECDH_compute_key EC_KEY_set_public_key RSA_public_decrypt EC_POINT_point2oct BN_bin2bn BN_is_bit_set DH_get0_key BN_hex2bn DH_set_length DH_new BN_is_negative DH_set0_pqg DH_generate_key EVP_sha384 EVP_MD_CTX_copy_ex EVP_MD_CTX_new EVP_md5 EVP_sha256 EVP_DigestUpdate EVP_Digest EVP_MD_CTX_free EVP_DigestInit_ex EVP_MD_CTX_md EVP_sha1 EVP_MD_block_size EVP_sha512 EVP_DigestFinal_ex RSA_blinding_on EC_GROUP_get_order BIO_new BN_clear_free ERR_peek_error BN_value_one EVP_PKEY_get1_EC_KEY EC_METHOD_get_field_type EC_POINT_mul ERR_get_error EC_POINT_get_affine_coordinates_GFp ERR_peek_last_error EC_KEY_set_group EC_POINT_is_at_infinity BIO_s_mem RSA_get0_key PEM_read_bio_PrivateKey EC_POINT_free EVP_aes_128_cbc EVP_PKEY_free EVP_PKEY_get1_RSA EC_KEY_get0_public_key EC_GROUP_free EC_POINT_new BIO_write BIO_free EC_GROUP_cmp EVP_PKEY_get1_DSA EC_GROUP_set_asn1_flag EC_GROUP_get_curve_name BN_new EC_KEY_get0_private_key EC_KEY_get0_group BN_cmp BN_sub EC_GROUP_new_by_curve_name EVP_PKEY_base_id EC_GROUP_method_of BN_num_bits timegm RAND_poll RAND_seed arc4random_buf RAND_bytes OpenSSL_version DH_free DH_get0_pqg gettimeofday arc4random_uniform

ws2_32

ntohs WSASocketW ntohl WSADuplicateSocketW closesocket inet_ntoa inet_ntop setsockopt WSAGetOverlappedResult getsockopt WSARecv GetAddrInfoW gethostname socket getsockname getpeername WSAGetLastError WSAStartup getnameinfo getservbyname htonl htons listen shutdown WSASend WSACleanup WSAIoctl bind FreeAddrInfoW

advapi32

LookupPrivilegeValueA EventWrite FreeSid AllocateAndInitializeSid DuplicateToken EqualSid LsaNtStatusToWinError RegQueryValueExW GetAce CreateWellKnownSid CopySid GetNamedSecurityInfoW IsValidSecurityDescriptor OpenProcessToken GetLengthSid IsValidAcl LookupAccountNameW AllocateLocallyUniqueId IsWellKnownSid AdjustTokenPrivileges LsaManageSidNameMapping RegOpenKeyExW RegEnumValueW RegCloseKey SetServiceStatus RegCreateKeyExW RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW ConvertStringSecurityDescriptorToSecurityDescriptorW IsValidSid CheckTokenMembership LookupAccountSidW GetSidIdentifierAuthority GetTokenInformation CreateProcessAsUserW ConvertSidToStringSidW EventUnregister EventRegister EventWriteTransfer CreateRestrictedToken ConvertSidToStringSidA

kernel32

FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetCommandLineW GetCommandLineA DeleteFileW GetFullPathNameW SetFileAttributesW RemoveDirectoryW SetStdHandle GetCurrentDirectoryW SetCurrentDirectoryW ExitProcess RtlPcToFileHeader RaiseException EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError RtlUnwindEx GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext FindClose FindFirstFileExW ExitThread CancelIoEx CancelSynchronousIo WriteFile ReadFile WaitForSingleObjectEx WaitForMultipleObjectsEx GetDriveTypeW GetDiskFreeSpaceExW GetLogicalDriveStringsW FindNextFileW GetFileAttributesExW GetFileInformationByHandle WriteFileEx DeviceIoControl CreateNamedPipeA CancelIo ReadConsoleOutputA SetConsoleCursorPosition GetConsoleWindow Beep WriteConsoleW FillConsoleOutputAttribute WriteConsoleOutputA CreateFileA ReadConsoleInputW SetConsoleCursorInfo GetConsoleMode SetConsoleWindowInfo GetConsoleCursorInfo ScrollConsoleScreenBufferA SetConsoleScreenBufferSize SetConsoleTextAttribute FillConsoleOutputCharacterA LoadLibraryExW MultiByteToWideChar CreateWaitableTimerA CancelWaitableTimer QueueUserAPC SetConsoleCtrlHandler GetExitCodeProcess FreeLibraryAndExitThread HeapAlloc HeapFree GetModuleHandleExW GetSystemTime GetWindowsDirectoryW GetSystemDirectoryW CreateEventA VerifyVersionInfoW SleepEx VerSetConditionMask ResetEvent SetEvent FlushFileBuffers OpenThread SetFilePointerEx GetTickCount64 ReadFileEx GetCurrentThreadId SetEndOfFile CreateThread SetHandleInformation FlsAlloc FlsGetValue FlsSetValue FlsFree GetLastError CloseHandle GetComputerNameW InitializeCriticalSectionEx VirtualProtect WaitForSingleObject GetFileAttributesW GetDateFormatW GetTimeFormatW CompareStringW CreateProcessW CopyFileW LCMapStringW SetInformationJobObject GetCurrentProcess ExpandEnvironmentStringsW AssignProcessToJobObject TerminateProcess SetEnvironmentVariableW CreateJobObjectW GetEnvironmentVariableW DuplicateHandle OpenProcess FormatMessageW LocalFree HeapReAlloc FormatMessageA GetModuleFileNameW GetConsoleOutputCP SetConsoleMode CreateDirectoryW GetTimeZoneInformation GetFileSizeEx SetWaitableTimer GetConsoleScreenBufferInfo GetStringTypeW GetStdHandle CreateWaitableTimerW ReadConsoleW CreateFileW Sleep IsValidCodePage GetACP GetOEMCP LoadLibraryW GetCPInfo RtlUnwind FreeLibrary WideCharToMultiByte GetFileType GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW GetFinalPathNameByHandleW GetProcessHeap HeapSize GetLocalTime GetProcAddress

secur32

LsaConnectUntrusted LsaDeregisterLogonProcess LsaFreeReturnBuffer LsaLogonUser InitSecurityInterfaceW LsaLookupAuthenticationPackage LsaRegisterLogonProcess FreeContextBuffer

userenv

LoadUserProfileW

crypt32

CryptBinaryToStringA CryptStringToBinaryA

user32

ShowWindow GetWindowPlacement

Name

.text

Size

920KB

Virtual Size

920KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

326KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-27_748e97c8645aa117dff967e1c7ece0d4_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar

libcrypto

ws2_32

advapi32

kernel32

secur32

userenv

crypt32

user32

generic