General
- Target 2026-10-01_869349a9b2b7a3b39577a9e5bbe07897_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 30.4MB
- Sample261002-lye18av13q
- SHA256 c47a6564d22f1f9b6c5e75e189e8d81e6f800cf6e552eed9a683bb87e2d7cf45
- MD5 869349a9b2b7a3b39577a9e5bbe07897
- SHA1 aa62cbc28bdd106317de676170c035196f4fa6a1
- SHA512 d71ee3d08532079d2f45bdea9e3ae2fa4b0cfa33d209fafef4f4ea04173893e0f16923469d3d31a35bfa8a21e0878640c0b9ced5c5adb3cea4079fa8398aad33
- SSDEEP 786432:WvUMOtzWW8TwcpY1QtI8QOjTNGCgeNuCuAVsM8ax6pk5nVmv:WvUMOtKWKdpUiINK4cNPZVyasv
- TLSH T19A673386B692186DD48DA73AF2D8852767D279DB0164C1CB6FE40A060F532F5EF39F20
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-10-01_869349a9b2b7a3b39577a9e5bbe07897_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_869349a9b2b7a3b39577a9e5bbe07897_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-01_869349a9b2b7a3b39577a9e5bbe07897_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 30.4MB
- SHA256 c47a6564d22f1f9b6c5e75e189e8d81e6f800cf6e552eed9a683bb87e2d7cf45
- MD5 869349a9b2b7a3b39577a9e5bbe07897
- SHA1 aa62cbc28bdd106317de676170c035196f4fa6a1
- SHA512 d71ee3d08532079d2f45bdea9e3ae2fa4b0cfa33d209fafef4f4ea04173893e0f16923469d3d31a35bfa8a21e0878640c0b9ced5c5adb3cea4079fa8398aad33
- SSDEEP 786432:WvUMOtzWW8TwcpY1QtI8QOjTNGCgeNuCuAVsM8ax6pk5nVmv:WvUMOtKWKdpUiINK4cNPZVyasv
- TLSH T19A673386B692186DD48DA73AF2D8852767D279DB0164C1CB6FE40A060F532F5EF39F20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Loads dropped DLL