General
- Target 2026-10-15_ee4602374d4cf5e854cd5893ce6616fa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 18.8MB
- Sample261015-3vsataey3l
- SHA256 a0280db41370950e14d7554b0f2605551a8a13ac4aaaac97a4cde2bc75613fb1
- MD5 ee4602374d4cf5e854cd5893ce6616fa
- SHA1 24aba60537a1ce08162ad4bc693a031a91ac91ab
- SHA512 616615138949145ec3bab23f28eb789552cba72b74353800407780e674c14d123f4f5115c054ee45d681655b738d4e8b2c670340fca168933dfc113bfdc330e1
- SSDEEP 393216:AUywyjPZE34Ja5nGmIFFXSYSoiHVBSC7eNGbV/zPXHTgodjPavQf95OPG:Vy1+O5v/ziHVB/SobdfHTgodivQfWe
- TLSH T1EA1733A0D590A1BAF8BB603D59F7D0A1D572B3140F7399DF0A8806952E3B1D58E3DBB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-10-15_ee4602374d4cf5e854cd5893ce6616fa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-15_ee4602374d4cf5e854cd5893ce6616fa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-15_ee4602374d4cf5e854cd5893ce6616fa_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 18.8MB
- SHA256 a0280db41370950e14d7554b0f2605551a8a13ac4aaaac97a4cde2bc75613fb1
- MD5 ee4602374d4cf5e854cd5893ce6616fa
- SHA1 24aba60537a1ce08162ad4bc693a031a91ac91ab
- SHA512 616615138949145ec3bab23f28eb789552cba72b74353800407780e674c14d123f4f5115c054ee45d681655b738d4e8b2c670340fca168933dfc113bfdc330e1
- SSDEEP 393216:AUywyjPZE34Ja5nGmIFFXSYSoiHVBSC7eNGbV/zPXHTgodjPavQf95OPG:Vy1+O5v/ziHVB/SobdfHTgodivQfWe
- TLSH T1EA1733A0D590A1BAF8BB603D59F7D0A1D572B3140F7399DF0A8806952E3B1D58E3DBB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.