2026-10-10_9e62eb0ec51420880775aa6946ad1855_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_9e62eb0ec51420880775aa6946ad1855_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 4.3MB
Sample261011-h17bpsfs3m
SHA256 1938890b0f36c9472c2d56654489778f13384f61909363c670b418eefff45952
MD5 9e62eb0ec51420880775aa6946ad1855
SHA1 326424ceba4698da3a0df01b1827a2b1ffee6ad4
SHA512 2feccdebe1fb950980aec0299ddc07b895734856b33531128f8566be6fc1215cce2e68ac99386ecbdd3eb513215fd56fae1ef9baf3971e54266913fe315157c7
SSDEEP 49152:S2duHAl4+cK65aHD2FVOJsgZdVXZtROGvnOKa/NO962EDgmovIhorGEcSORfQQe6:BWa8E962EDgmovI0rodYbJzl8
TLSH
T1B1269E1A7AAD00F9C1BEC0388557551BEEB23496033597DB66E0CE652F23AF16E3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_9e62eb0ec51420880775aa6946ad1855_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-10_9e62eb0ec51420880775aa6946ad1855_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 4.3MB

2026-10-10_9e62eb0ec51420880775aa6946ad1855_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH c4cb2e624081e55bf08068cca6aa9b06
SHA256 1938890b0f36c9472c2d56654489778f13384f61909363c670b418eefff45952
MD5 9e62eb0ec51420880775aa6946ad1855
SHA1 326424ceba4698da3a0df01b1827a2b1ffee6ad4
SHA512 2feccdebe1fb950980aec0299ddc07b895734856b33531128f8566be6fc1215cce2e68ac99386ecbdd3eb513215fd56fae1ef9baf3971e54266913fe315157c7
SSDEEP 49152:S2duHAl4+cK65aHD2FVOJsgZdVXZtROGvnOKa/NO962EDgmovIhorGEcSORfQQe6:BWa8E962EDgmovI0rodYbJzl8
TLSH
T1B1269E1A7AAD00F9C1BEC0388557551BEEB23496033597DB66E0CE652F23AF16E3E701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1426560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BUILD\work\3ec84b7238d5b18a\BUILDS\Release\x64\overseer.pdb

winhttp

WinHttpReceiveResponse WinHttpGetProxyForUrl WinHttpSetTimeouts WinHttpReadData WinHttpQueryHeaders WinHttpCloseHandle WinHttpSendRequest WinHttpSetOption WinHttpOpenRequest WinHttpConnect WinHttpOpen WinHttpCrackUrl

bcrypt

BCryptEncrypt BCryptSecretAgreement BCryptImportKeyPair BCryptGenRandom BCryptFinalizeKeyPair BCryptExportKey BCryptGenerateSymmetricKey BCryptDeriveKey BCryptSetProperty BCryptOpenAlgorithmProvider BCryptDestroySecret BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenerateKeyPair

advapi32

RegOpenKeyExW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptAcquireContextA CryptReleaseContext AllocateAndInitializeSid OpenSCManagerW OpenServiceW QueryServiceStatusEx CloseServiceHandle ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyExW RegSetValueExW RegCloseKey QueryServiceStatus EventWriteTransfer EventRegister EventUnregister CryptGenRandom CryptAcquireContextW RegDeleteTreeW RegDeleteKeyExW RegGetValueW RegQueryInfoKeyW LookupAccountSidW RegQueryMultipleValuesW RegDeleteValueW RegEnumValueW RegEnumKeyExW RegQueryValueExW OpenThreadToken GetTokenInformation OpenProcessToken EqualSid RevertToSelf ControlService StartServiceW ConvertStringSidToSidW FreeSid LookupPrivilegeValueW AdjustTokenPrivileges ImpersonateSelf GetFileSecurityW ConvertSecurityDescriptorToStringSecurityDescriptorW

user32

GetClassInfoExW CharLowerW LoadStringW RegisterClassExW

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQuerySessionInformationW

oleaut32

VariantClear SysFreeString SysAllocString VariantInit

ole32

CoCreateInstance CoUninitialize CoTaskMemFree CoInitializeEx

shell32

ShellExecuteExW SHGetKnownFolderPath

shlwapi

PathIsRootW PathMatchSpecW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ntdll

VerSetConditionMask NtClose NtSetInformationThread RtlNtStatusToDosError NtOpenKey NtQueryKey NtDeleteKey RtlUnwind RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlPcToFileHeader RtlGetLastNtStatus RtlUnwindEx

kernel32

LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WakeConditionVariable WakeAllConditionVariable FreeLibraryWhenCallbackReturns CreateThreadpoolWork GetTimeZoneInformation SubmitThreadpoolWork GetConsoleOutputCP GetConsoleMode FlsFree ReadConsoleW CloseThreadpoolWork FlsSetValue GetLocaleInfoEx WaitForSingleObjectEx SwitchToThread FlsGetValue FlsAlloc SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType ExitProcess GetStdHandle FreeLibraryAndExitThread ExitThread CreateThread InterlockedPushEntrySList GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead GetCPInfo GetTickCount64 MultiByteToWideChar WideCharToMultiByte GetLastError GetFullPathNameW GetFileAttributesW SetLastError GetCompressedFileSizeW CreateFileW CloseHandle GetFileInformationByHandle CopyFileW GetComputerNameW OpenMutexW OpenProcess GetProcessTimes CreateToolhelp32Snapshot Process32FirstW Process32NextW OutputDebugStringW GetCurrentThreadId FormatMessageW IsDebuggerPresent GetFileSizeEx ReadFile OutputDebugStringA GetModuleHandleW FindResourceW LoadResource SizeofResource GetSystemPowerStatus GetCurrentProcessId SetDllDirectoryW GetProcAddress LocalFree CreateMutexW HeapSetInformation SetPriorityClass GetCurrentProcess GetLocaleInfoA FlushFileBuffers MoveFileExW GetFinalPathNameByHandleW GetFileAttributesExW TerminateProcess ReleaseMutex WaitForSingleObject GetCommandLineW GetModuleFileNameA HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap DebugBreak CompareStringW LeaveCriticalSection EnterCriticalSection GetOverlappedResult DeviceIoControl CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatus WriteFile CancelIoEx WaitForMultipleObjects CreateEventW SetEvent ResetEvent VirtualAlloc WerRegisterMemoryBlock WerUnregisterMemoryBlock VirtualFree QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimeAsFileTime InitOnceExecuteOnce AcquireSRWLockExclusive ReleaseSRWLockExclusive UnmapViewOfFile UnlockFile CreateFileMappingW MapViewOfFile LockFileEx Sleep GetExitCodeProcess ResumeThread UnlockFileEx InitializeCriticalSection QueryUnbiasedInterruptTime TerminateThread GetTickCount GetStringTypeW GetCurrentThread RaiseException GetThreadTimes InitializeCriticalSectionAndSpinCount QueryThreadCycleTime SetEndOfFile SetFilePointerEx LocalAlloc InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute K32GetProcessImageFileNameW CreateProcessW ProcessIdToSessionId VerifyVersionInfoW WTSGetActiveConsoleSessionId FileTimeToSystemTime LoadLibraryW CompareFileTime QueryFullProcessImageNameW DeleteFileW TlsAlloc TlsGetValue TlsSetValue FreeLibrary CreateSemaphoreW ReleaseSemaphore GetSystemInfo GetVersionExW ExpandEnvironmentStringsW GetModuleFileNameW LoadLibraryExW GetSystemDirectoryW VirtualProtect GlobalMemoryStatusEx GetEnvironmentVariableW GetDateFormatW GetTimeFormatW GetExitCodeThread TlsFree GetDriveTypeW SetFilePointer SetFileAttributesW GetFileSize GetWindowsDirectoryW DuplicateHandle FindFirstFileW FindClose SetFileTime CreateDirectoryW GetCurrentDirectoryW FindFirstFileExW FindNextFileW QueryDosDeviceW GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetDiskFreeSpaceExW WriteProcessMemory GetVersion LockResource FindResourceExW SetEnvironmentVariableW IsProcessorFeaturePresent SetThreadAffinityMask SetFileInformationByHandle K32GetMappedFileNameW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose GetSystemTimes GetSystemDirectoryA GetModuleHandleA LoadLibraryA FormatMessageA SleepEx MoveFileExA GetEnvironmentVariableA CompareStringEx ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive SleepConditionVariableSRW InitOnceBeginInitialize LCMapStringEx IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapQueryInformation WriteConsoleW GlobalFree SetThreadPriority InitOnceComplete AreFileApisANSI GetModuleHandleExW EncodePointer

fltlib

FilterLoad FilterReplyMessage FilterGetMessage FilterSendMessage FilterConnectCommunicationPort

crypt32

CertGetCertificateChain CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertFreeCertificateChain

ws2_32

getsockopt send WSACloseEvent freeaddrinfo getaddrinfo ioctlsocket htonl select __WSAFDIsSet WSAIoctl WSASetLastError socket setsockopt recv ntohs htons getsockname connect closesocket bind WSACleanup WSAStartup WSAGetLastError WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent

iphlpapi

if_nametoindex

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

765KB

Virtual Size

765KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

74KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

770KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=219, id=261, version=33138,

count=4, id=253, version=34321,

count=18, id=260, version=34321,

count=10, id=259, version=34321,

count=123, id=261, version=34321,

count=11, id=259, version=33138,

count=37, id=260, version=33138,

count=20, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=6, id=260, version=32545,

count=125, id=260, version=30154,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=257, version=30795,

count=2, id=259, version=33520,

count=8, id=260, version=33520,

count=13, productName=Unmarked objects (old),

count=1, id=262, version=33138,

count=3, id=261, version=32545,

count=29, id=257, version=33138,

count=550, id=1, productName=Unmarked objects,

count=261, id=265, version=34436,

count=1, id=256, version=34436,

count=1, id=255, version=34436,

count=2, id=151,

count=1, id=258, version=34436,