General
- Target 2026-10-16_fbaf8940af042a2f244b547c8127486e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 14.5MB
- Sample261017-b1jgbazx4l
- SHA256 21467f51844c4254f6a87174bca17681ba6f303c188197b846377b797f500b3c
- MD5 fbaf8940af042a2f244b547c8127486e
- SHA1 173e9e6efcc991df4383c24bde34295b9712287d
- SHA512 2147b27f71f1af8d761570630179fbb07c4089116aae687234649084bae962d31d744bde59f437fe01e10dd617f9740e54712d9016cd7e1464b464df32bfdcf4
- SSDEEP 393216:ibAkyjPZE34JaAgKibuf7EEeYMOaLd3kD9JZbq:i0B+OIKoE8Oa6D9J5
- TLSH T1D5E633D5E39041A2D9B6923C52A2C239FB727D3403A0C6DB05E07D273E77ED249B9B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Behavioral task
behavioral1
Sample
2026-10-16_fbaf8940af042a2f244b547c8127486e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-16_fbaf8940af042a2f244b547c8127486e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-16_fbaf8940af042a2f244b547c8127486e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 14.5MB
- SHA256 21467f51844c4254f6a87174bca17681ba6f303c188197b846377b797f500b3c
- MD5 fbaf8940af042a2f244b547c8127486e
- SHA1 173e9e6efcc991df4383c24bde34295b9712287d
- SHA512 2147b27f71f1af8d761570630179fbb07c4089116aae687234649084bae962d31d744bde59f437fe01e10dd617f9740e54712d9016cd7e1464b464df32bfdcf4
- SSDEEP 393216:ibAkyjPZE34JaAgKibuf7EEeYMOaLd3kD9JZbq:i0B+OIKoE8Oa6D9J5
- TLSH T1D5E633D5E39041A2D9B6923C52A2C239FB727D3403A0C6DB05E07D273E77ED249B9B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Loads dropped DLL
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.