2026-10-05_db1f3be2ccf54fc51528b947c5064e97_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-05_db1f3be2ccf54fc51528b947c5064e97_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 17.8MB
Sample261006-tkmsxaaw4w
SHA256 5900278c4faa9460a97c8bedf8da8a658660c266cd6b1b5a79d03064bd6f3c00
MD5 db1f3be2ccf54fc51528b947c5064e97
SHA1 6ad2a5cffba6480f9a2d2e94b93370179cf3c13e
SHA512 9d2e4c6547a15fe12f156bf740f98756102b3d0316df06370a2a74a8cbd8e0643d8ea7ad9dfb0b59ef1ee9b11365429857659252715277db1b728ae62715d792
SSDEEP 393216:O5Oq2v76Vmw7J6ivwYwIZSKly1pw6enx/hqWbdXQfM6R4RmhNHHsnvDwHCxt7C4:iOq2v76Vmw7J6iBwkNly7w66xvYMc3Nk
TLSH
T16117F0123382D812D4552CFB6D5DDAD9E371B9C19E0B63A332415B3F5EFE6928C29B80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-05_db1f3be2ccf54fc51528b947c5064e97_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-10-05_db1f3be2ccf54fc51528b947c5064e97_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 17.8MB
auth.pyc

2KB

2026-10-05_db1f3be2ccf54fc51528b947c5064e97_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 69b29dafab53e55d70c76de3c2f73773
SHA256 5900278c4faa9460a97c8bedf8da8a658660c266cd6b1b5a79d03064bd6f3c00
MD5 db1f3be2ccf54fc51528b947c5064e97
SHA1 6ad2a5cffba6480f9a2d2e94b93370179cf3c13e
SHA512 9d2e4c6547a15fe12f156bf740f98756102b3d0316df06370a2a74a8cbd8e0643d8ea7ad9dfb0b59ef1ee9b11365429857659252715277db1b728ae62715d792
SSDEEP 393216:O5Oq2v76Vmw7J6ivwYwIZSKly1pw6enx/hqWbdXQfM6R4RmhNHHsnvDwHCxt7C4:iOq2v76Vmw7J6iBwkNly7w66xvYMc3Nk
TLSH
T16117F0123382D812D4552CFB6D5DDAD9E371B9C19E0B63A332415B3F5EFE6928C29B80
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

394340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9

user32

TranslateMessage DispatchMessageW PeekMessageW SendMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetLayeredWindowAttributes GetAsyncKeyState GetKeyNameTextW LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadIconW MessageBoxW GetWindowRect ReleaseDC GetDC GetSystemMetrics ReleaseCapture MapVirtualKeyW SendInput

gdi32

SetBrushOrgEx DeleteDC DeleteObject SelectObject StretchBlt SetStretchBltMode CreateCompatibleDC CreateDIBSection

winmm

timeBeginPeriod timeEndPeriod PlaySoundW

dwmapi

DwmExtendFrameIntoClientArea

ole32

CoInitializeEx CoCreateInstance CoUninitialize

kernel32

FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc OutputDebugStringW HeapAlloc HeapFree ExitProcess ReadFile IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW WriteConsoleW GetModuleHandleExW GetModuleFileNameW GetFileType GetStdHandle LoadLibraryExW TlsFree TlsSetValue GetProcessHeap TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection GetEnvironmentVariableW CreateFileW DeleteFileW WriteFile GetTempPathW CloseHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject CreateMutexW Sleep GetCurrentProcessId GetExitCodeProcess CreateThread CreateProcessW GetTickCount64 GetWindowsDirectoryW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW MoveFileExW WideCharToMultiByte OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock MultiByteToWideChar FreeLibrary LoadLibraryA GetLocaleInfoA IsDBCSLeadByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW EnterCriticalSection EncodePointer SetLastError HeapSize HeapReAlloc SetEndOfFile TlsGetValue GlobalFree RtlPcToFileHeader RaiseException RtlUnwindEx

shell32

ShellExecuteW

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

548KB

Virtual Size

548KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

185KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17.0MB

Virtual Size

17.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-05_db1f3be2ccf54fc51528b947c5064e97_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

d3d9

user32

gdi32

winmm

dwmapi

ole32

kernel32

shell32

imm32

generic

auth.pyc