Extracted

• • Target
    2026-10-22_ff2c0c2ae8292b112d6a2c97285d4e5d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
  • Size 45.1MB
  • SHA256 5ea5b7e37ba45ef109d9df11a1237d029d9bace2c3258558698717a475ac6987
  • MD5 ff2c0c2ae8292b112d6a2c97285d4e5d
  • SHA1 7ecce10fc604800ddee72453b40a51f5135f0974
  • SHA512 8515a5858a311b66f9a0233247061c1861c85c1015ce9b5b5691004d448ac722e6fa4e5f14786e6a51cffd1b10f2a4a42fe302128e22d69e79e97ecf6903f962
  • SSDEEP 786432:HqzbS4ce2s7bUaEkABXNVTU2E7BvU+OWrhsqP6bxW2m/vnlziHVB/knPyHvlfFwh:Hqq4f/PUvkAB9VwOWrfP6mnVM/RFwh
  • TLSH
    T18FA73391ED8192FBDCFBD03968FBA096D602A64B4772A5FF07480B9819771C4DE35A30
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcollectioncredential_accessdefense_evasiondiscoveryexecutionasyncratpersistenceprivilege_escalationpyinstallerratspywarestealer

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Detects executables attemping to enumerate video devices using WMI

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2