General
- Target 2026-09-30_907e858cf07b24751f44c1cc95a4ca09_blankgrabber_cobalt-strike_coinminer_icedid_megazord_njrat_ryuk_satacom
- Size 20.6MB
- Sample260930-lmh9hatxes
- SHA256 e36e2de291d9097aa163fc9d9ebb2f2a10a8241f91942e9e197346b427360d24
- MD5 907e858cf07b24751f44c1cc95a4ca09
- SHA1 40380d88722be8abc312b0046e839173d7d5cb12
- SHA512 61455b475afe7a832ed89cf9539b2a9610083d5f649cca61a19b4df9e19c2576bc45c48c3e898a509ebfaab03c7b149b4570ff08c0de5a763e4f2699def13852
- SSDEEP 393216:tu9PPWyN5ovaL8obNnR985T7xxvZE84+ccpqm6u58/ER9sipLez:tu92yN5ovw8oJRSx6+ckEuC/EQipLez
- TLSH T1392733127701D2EFF46791BC99C86A51FA8738A62344DBCB423986A91F27FC4C93531A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_907e858cf07b24751f44c1cc95a4ca09_blankgrabber_cobalt-strike_coinminer_icedid_megazord_njrat_ryuk_satacom.exe
Resource
win10v2004-20260911-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_907e858cf07b24751f44c1cc95a4ca09_blankgrabber_cobalt-strike_coinminer_icedid_megazord_njrat_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-30_907e858cf07b24751f44c1cc95a4ca09_blankgrabber_cobalt-strike_coinminer_icedid_megazord_njrat_ryuk_satacom
- Size 20.6MB
- SHA256 e36e2de291d9097aa163fc9d9ebb2f2a10a8241f91942e9e197346b427360d24
- MD5 907e858cf07b24751f44c1cc95a4ca09
- SHA1 40380d88722be8abc312b0046e839173d7d5cb12
- SHA512 61455b475afe7a832ed89cf9539b2a9610083d5f649cca61a19b4df9e19c2576bc45c48c3e898a509ebfaab03c7b149b4570ff08c0de5a763e4f2699def13852
- SSDEEP 393216:tu9PPWyN5ovaL8obNnR985T7xxvZE84+ccpqm6u58/ER9sipLez:tu92yN5ovw8oJRSx6+ckEuC/EQipLez
- TLSH T1392733127701D2EFF46791BC99C86A51FA8738A62344DBCB423986A91F27FC4C93531A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects Windows executables referencing non-Windows User-Agents
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.