2026-10-22_eb0903ca379f8e4e8c479bb10712b9a2_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_eb0903ca379f8e4e8c479bb10712b9a2_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc
Size 7.7MB
Sample261023-errm4szv7j
SHA256 797ce5c92f588d0006df7369540b90b8bd30187f8e9973ddbf40bd3bea98eadb
MD5 eb0903ca379f8e4e8c479bb10712b9a2
SHA1 cf7debf2c6b5ef997dff46089dea3bbb99a9c755
SHA512 b5033fd404fc8b3d1a857cba641d5ef7dc6184fb9f97c875a75e6657b721cdfbde33407a6593c114959118127dd5f5506d0e709be0a0dad7e631532ecb85c7dc
SSDEEP 196608:E3GYYdSp8x6JK0H5GfrVVzsKSmfEXrgp:E3GYYdSp8x6JK0H5GfrVVAKXcg
TLSH
T1F886AF69A6BC00D9E87BC1B9C6865227EF71B414177057CF5AA08AE61F23EE01E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Custom signature

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_eb0903ca379f8e4e8c479bb10712b9a2_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-10-22_eb0903ca379f8e4e8c479bb10712b9a2_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

.exe 7.7MB

2026-10-22_eb0903ca379f8e4e8c479bb10712b9a2_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

IMPHASH c86a14362044bf84c0f9a5e07333f6ad
SHA256 797ce5c92f588d0006df7369540b90b8bd30187f8e9973ddbf40bd3bea98eadb
MD5 eb0903ca379f8e4e8c479bb10712b9a2
SHA1 cf7debf2c6b5ef997dff46089dea3bbb99a9c755
SHA512 b5033fd404fc8b3d1a857cba641d5ef7dc6184fb9f97c875a75e6657b721cdfbde33407a6593c114959118127dd5f5506d0e709be0a0dad7e631532ecb85c7dc
SSDEEP 196608:E3GYYdSp8x6JK0H5GfrVVzsKSmfEXrgp:E3GYYdSp8x6JK0H5GfrVVAKXcg
TLSH
T1F886AF69A6BC00D9E87BC1B9C6865227EF71B414177057CF5AA08AE61F23EE01E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Reflective DLL injection artifacts
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4899776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSAStartup socket getaddrinfo freeaddrinfo inet_pton getsockopt WSACloseEvent WSACreateEvent WSAEnumNetworkEvents setsockopt WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSAGetLastError accept bind send recv htons connect WSACleanup getpeername shutdown getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr gethostbyname gethostname ioctlsocket sendto recvfrom listen htonl select __WSAFDIsSet WSAIoctl WSASetLastError ntohs getsockname closesocket

crypt32

CertOpenSystemStoreW CertGetCertificateContextProperty CertDuplicateCertificateContext CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptStringToBinaryA CryptUnprotectData

bcrypt

BCryptDeriveKeyPBKDF2 BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptEncrypt BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptHash BCryptGenRandom BCryptDecrypt

secur32

InitSecurityInterfaceW

iphlpapi

if_nametoindex

advapi32

DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom ReportEventW RegisterEventSourceW GetSecurityInfo CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegCloseKey GetUserNameA

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

ole32

CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

VariantClear SysFreeString SysAllocString

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree ExitThread FreeLibraryAndExitThread GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetConsoleOutputCP RtlUnwindEx ExitProcess SetConsoleCtrlHandler RtlLookupFunctionEntry SetStdHandle InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo GetStringTypeW LCMapStringEx DecodePointer GetCurrentProcess RtlPcToFileHeader RtlCaptureContext IsDebuggerPresent UnhandledExceptionFilter IsProcessorFeaturePresent GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW Process32NextW EncodePointer CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW CopyFile2 DeviceIoControl CreateFile2 SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle FindFirstFileExW GetCurrentDirectoryW GetLocaleInfoEx GetStdHandle GetEnvironmentVariableW ExpandEnvironmentStringsW ReadFile WriteFile CloseHandle GetLastError ConnectNamedPipe PeekNamedPipe CreateNamedPipeW WaitForSingleObject CreateEventA Sleep CreateProcessW GetTickCount GetModuleHandleA GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW WideCharToMultiByte GetConsoleScreenBufferInfo SetConsoleTextAttribute GetEnvironmentVariableA CreateDirectoryW CreateFileA CreateFileW FlushFileBuffers GetDiskFreeSpaceExA GetDriveTypeA GetFileAttributesW GetLogicalDrives SetFileAttributesW GetTempPathW GetTempPathA GetVolumeInformationA AddVectoredExceptionHandler InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcessId TerminateProcess OpenProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount64 GetSystemDirectoryA GetWindowsDirectoryA FreeLibrary LoadLibraryExW LoadLibraryW LocalFree FindResourceA SetDllDirectoryW GetComputerNameA CreateToolhelp32Snapshot Process32FirstW RtlUnwind Process32First Process32Next QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepEx InitializeCriticalSectionEx QueryPerformanceFrequency SetLastError FindFirstFileW MoveFileExW InitializeConditionVariable VerSetConditionMask VerifyVersionInfoW FindClose FindNextFileW GetFileType WaitForMultipleObjects WakeConditionVariable SleepConditionVariableCS CreateThread RtlVirtualUnwind InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW VirtualProtect VirtualFree GetACP ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetModuleFileNameW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetFileSizeEx GetFileTime SetFilePointerEx

Name

.text

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

215KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1010KB

Virtual Size

1010KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_eb0903ca379f8e4e8c479bb10712b9a2_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

ws2_32

crypt32

bcrypt

secur32

iphlpapi

advapi32

rpcrt4

ole32

oleaut32

user32

kernel32

generic