General
- Target 2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 5.7MB
- Sample261023-y1gdaade69
- SHA256 116a7bbe25ff2bb79a7775abcad3082acf7ba67ecee9d418c639bd74cc9a6d04
Score
8/10
Malware Config
Targets
-
- Target 2026-10-22_cce29239c77b609458aa7ed0abc5f864_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 5.7MB
- SHA256 116a7bbe25ff2bb79a7775abcad3082acf7ba67ecee9d418c639bd74cc9a6d04
Score8/10Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
Executes dropped EXE
Loads dropped DLL
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
Adds Run key to start application
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1File/Path Exclusions
1Impair Defenses
1Disable or Modify Tools
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
1