2026-10-22_5c5d6214d6127b866f76e878e90d86bb_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

General

Target
2026-10-22_5c5d6214d6127b866f76e878e90d86bb_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar
Size 54.8MB
Sample261024-n4vd7seh59
SHA256 5ed4878c5fb588df879c17702272c2239c98f10814317db43e08745d74a21efb
MD5 5c5d6214d6127b866f76e878e90d86bb
SHA1 a608d1dafc2ce03906c18f03d0a1b0c0eba642c3
SHA512 c06877537ae2b97d9caa82ad569ef84ca22eb3eeb2f379f38e9bc4a92fa9742f9a13e3339739a94595c310ea33f5f60f078c19e819f037a341fc6bd0e89ad361
SSDEEP 786432:Df/VN8jG0uMNAUTxqsHZx9pKMOd5zdoAs/e:DfNSpshSN/
TLSH
T163C77C1732B50096E9A6D078CE178A23DF70BC5A9720A3D75950B5BA2F37BE12F78314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Custom signature

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_5c5d6214d6127b866f76e878e90d86bb_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

File Explorer

2026-10-22_5c5d6214d6127b866f76e878e90d86bb_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

.exe 54.8MB

2026-10-22_5c5d6214d6127b866f76e878e90d86bb_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

IMPHASH e65dfb0a35117e66ba2952d56fbd1f9f
SHA256 5ed4878c5fb588df879c17702272c2239c98f10814317db43e08745d74a21efb
MD5 5c5d6214d6127b866f76e878e90d86bb
SHA1 a608d1dafc2ce03906c18f03d0a1b0c0eba642c3
SHA512 c06877537ae2b97d9caa82ad569ef84ca22eb3eeb2f379f38e9bc4a92fa9742f9a13e3339739a94595c310ea33f5f60f078c19e819f037a341fc6bd0e89ad361
SSDEEP 786432:Df/VN8jG0uMNAUTxqsHZx9pKMOd5zdoAs/e:DfNSpshSN/
TLSH
T163C77C1732B50096E9A6D078CE178A23DF70BC5A9720A3D75950B5BA2F37BE12F78314
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of MFA browser extension IDs.
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHGetFolderPathW CommandLineToArgvW

kernel32

DeleteCriticalSection WriteConsoleW CreateDirectoryW SetConsoleCtrlHandler GetCommandLineW GetFullPathNameW GetStdHandle WriteFile GetShortPathNameW TerminateProcess GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW GetTempPathW WaitForSingleObject CreateFileW UnmapViewOfFile GetLastError CloseHandle GetProcAddress GetFileSize GetCurrentProcessId CreateProcessW WideCharToMultiByte GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter SetDllDirectoryW GetExitCodeProcess GetCurrentThreadId InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW HeapReAlloc RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent GetCommandLineA RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter MultiByteToWideChar HeapAlloc HeapFree VirtualProtect LoadLibraryExW LCMapStringW GetFileType GetStringTypeW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize

Name

.text

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54.6MB

Virtual Size

54.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_5c5d6214d6127b866f76e878e90d86bb_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar

shell32

kernel32

generic