2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 18.0MB
Sample261018-x49cssgv8j
SHA256 fc3d348e478da0f8c2430e59de23bec022a6eb0110690cb516e5176ecf70be92
MD5 c91966f52a62887501b5634a52af972c
SHA1 5113d661ee079f359f7b891dd473ffc2e65c222b
SHA512 2367c4c7d4e792c5a7c5d05201504dee07e26ee97b447dfe1eec807cf448370fdb751fc01c12b37e2b665b2ee14c69a0db11413a07463fc90cd99d5b0b630d78
SSDEEP 393216:kZGkD/CU9LEotcQtXU3QxTf1z+zsvNYqxDNmXKLFRJsnrQQ:Y1CQxkoB/
TLSH
T139179E06F9E34F6EC17A853481938F17E638F04567319AB71364A2383ED27F856E6788
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 18.0MB

2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH b62988bc0a7007be34708f3e17b04d14
SHA256 fc3d348e478da0f8c2430e59de23bec022a6eb0110690cb516e5176ecf70be92
MD5 c91966f52a62887501b5634a52af972c
SHA1 5113d661ee079f359f7b891dd473ffc2e65c222b
SHA512 2367c4c7d4e792c5a7c5d05201504dee07e26ee97b447dfe1eec807cf448370fdb751fc01c12b37e2b665b2ee14c69a0db11413a07463fc90cd99d5b0b630d78
SSDEEP 393216:kZGkD/CU9LEotcQtXU3QxTf1z+zsvNYqxDNmXKLFRJsnrQQ:Y1CQxkoB/
TLSH
T139179E06F9E34F6EC17A853481938F17E638F04567319AB71364A2383ED27F856E6788
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2234656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\gops4\Downloads\cs2 (1)\cs2\user-mode\MemoryReaderCpp\x64\Release\MemoryReaderCpp.pdb

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

kernel32

QueryFullProcessImageNameW CreateFileMappingW MapViewOfFile SetDllDirectoryW MoveFileA FindFirstFileA FindNextFileA FindClose SwitchToThread VirtualQueryEx GetTempPathA GetWindowsDirectoryA ReleaseSRWLockExclusive CreateFileA AcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared SystemTimeToTzSpecificLocalTime GetFileTime GetLocaleInfoA LoadLibraryA VerSetConditionMask LocalFree FormatMessageW SleepEx MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetSystemInfo VirtualAlloc GetFileAttributesW OutputDebugStringA OutputDebugStringW LoadLibraryExW LocalAlloc GetEnvironmentVariableW SetStdHandle CreatePipe GetTimeZoneInformation FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetConsoleOutputCP ReadConsoleW GetConsoleMode CheckRemoteDebuggerPresent GetCommandLineA SetFilePointerEx GetDriveTypeW UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext DuplicateHandle WriteConsoleW GetModuleHandleExW FreeLibraryAndExitThread ExitThread IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry RaiseException GetStartupInfoW InitializeSListHead GetCPInfo GetStringTypeW LCMapStringEx HeapDestroy WakeAllConditionVariable HeapSize InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW GetSystemTimePreciseAsFileTime GetLocaleInfoEx FormatMessageA GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW GetCurrentDirectoryW GetProcessHeap IsDebuggerPresent GetLocalTime K32EnumProcessModules GetSystemTimeAsFileTime CreateProcessA DeleteFileA FileTimeToSystemTime K32GetModuleFileNameExA GetFileAttributesExA GetExitCodeProcess GlobalUnlock CreateDirectoryA Module32NextW WideCharToMultiByte CopyFileW FreeLibrary CreateProcessW DeleteCriticalSection GlobalLock Module32FirstW RtlUnwind FindResourceW LoadResource GlobalFree GetModuleHandleA DeleteFileW GlobalAlloc LockResource GetFileAttributesA MultiByteToWideChar CreateFileW GetTempPathW InitializeCriticalSection LeaveCriticalSection GetModuleFileNameW WriteFile EnterCriticalSection GetFileSizeEx SizeofResource ReadFile CreateDirectoryW SetUnhandledExceptionFilter OpenThread VirtualQuery GetTickCount QueryPerformanceCounter GetModuleHandleW GetCurrentProcessId ReadProcessMemory ExitProcess GetProcAddress AddVectoredExceptionHandler CreateThread LoadLibraryW CloseHandle Process32FirstW QueryPerformanceFrequency GetCurrentThread Process32NextW GetLastError DecodePointer HeapAlloc HeapReAlloc EncodePointer Sleep CreateToolhelp32Snapshot OpenProcess GetTickCount64 UnmapViewOfFile GetSystemDirectoryW InitializeCriticalSectionEx AddDllDirectory SetDefaultDllDirectories HeapFree RtlCaptureStackBackTrace GetCurrentThreadId VirtualProtect WaitForSingleObject CreateMutexW SetThreadPriority TerminateProcess DeviceIoControl GetCurrentProcess SetPriorityClass SetLastError GetModuleFileNameA SetEndOfFile IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCommandLineW

user32

RegisterClassW PeekMessageW ClientToScreen DispatchMessageW GetAsyncKeyState ShowWindow GetClassNameA GetSystemMetrics CreateWindowExW SetWindowLongPtrW SetWindowPos IsWindowVisible DestroyWindow GetWindow GetWindowThreadProcessId GetWindowTextW EnableWindow EndPaint BeginPaint EnumWindows ReleaseDC InvalidateRect PtInRect SetProcessDPIAware PostQuitMessage SetLayeredWindowAttributes DrawTextW SetWindowLongW SetCursor GetClipboardData SetFocus MapWindowPoints CloseClipboard SetTimer OpenClipboard RegisterClassExW MessageBeep SetWindowTextW UnregisterClassW MessageBoxA GetCursorPos TranslateMessage LoadCursorW SendMessageW ScreenToClient FillRect SetWindowRgn MonitorFromWindow GetDC GetWindowRect MonitorFromPoint PostMessageW DefWindowProcW GetMessageW GetForegroundWindow GetWindowTextLengthW GetWindowLongW FindWindowA SetClipboardData GetClientRect SetForegroundWindow IsIconic KillTimer EmptyClipboard GetWindowLongPtrW GetDpiForWindow mouse_event keybd_event GetKeyState GetMessageExtraInfo GetCapture TrackMouseEvent GetKeyboardLayout SetCapture IsWindowUnicode ReleaseCapture SetCursorPos

gdi32

BitBlt AddFontResourceExW CreateDIBSection CreateCompatibleDC CreateFontW GetStockObject CreateRoundRectRgn GetDeviceCaps DeleteDC GetTextExtentPoint32W SetTextColor SetBkMode LineTo CreatePen SelectClipRgn MoveToEx SetBkColor Ellipse DeleteObject CreateSolidBrush RemoveFontResourceExW RoundRect SelectObject

advapi32

EventWriteTransfer RegQueryValueExW RegOpenKeyExW OpenProcessToken RegCloseKey AddAccessAllowedAce GetLengthSid SetSecurityInfo InitializeAcl IsValidSid GetUserNameA RegCreateKeyExA RegDeleteKeyA RegOpenKeyExA RegQueryValueExA ConvertSidToStringSidW CopySid CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey GetSidSubAuthority GetSidSubAuthorityCount RegGetValueW EventUnregister GetTokenInformation EventSetInformation EventRegister SystemFunction036 CryptEncrypt

shell32

ShellExecuteExW ShellExecuteW SHGetFolderPathA ShellExecuteA

ole32

CoCreateInstance CreateStreamOnHGlobal CoInitializeEx CoTaskMemFree CoTaskMemAlloc CoUninitialize

winmm

timeBeginPeriod

dwrite

DWriteCreateFactory

msimg32

GradientFill AlphaBlend

winhttp

WinHttpCloseHandle WinHttpOpenRequest WinHttpSetTimeouts WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpConnect WinHttpSendRequest

psapi

GetModuleInformation

crypt32

CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx CertFindCertificateInStore

ws2_32

getaddrinfo bind freeaddrinfo inet_pton gethostname ioctlsocket sendto recvfrom listen htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect ntohl WSACleanup WSAStartup WSASetLastError ntohs WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt inet_ntop

shlwapi

PathFindFileNameW

wintrust

WinVerifyTrust

dnsapi

DnsQuery_A DnsFree

dcomp

DCompositionCreateDevice

dxgi

CreateDXGIFactory1

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

827KB

Virtual Size

826KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

133KB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14.6MB

Virtual Size

14.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

d3d11

d3dcompiler_47

dwmapi

kernel32

user32

gdi32

advapi32

shell32

ole32

winmm

dwrite

msimg32

winhttp

psapi

crypt32

ws2_32

shlwapi

wintrust

dnsapi

dcomp

dxgi

imm32

userenv

bcrypt

generic