General
- Target 2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc
- Size 30.8MB
- Sample261027-cl1bysxx3m
- SHA256 83cc03f7f347543373591ab9a4b4d7f011005e9b81815bcac882c3ab00f240f6
- MD5 f4cf41a2213d93c0b83c5149c69e903e
- SHA1 8448dbbc3c224bfa08c32334e7284b24d4dea9fc
- SHA512 c10a9c43de024430034a0c21fbca64d42decc76338b05cfefcf28473a856f71e5c068e8228383fe4bffb426bf2ad4b0f0426a984092e57ae1365980413252c65
- SSDEEP 393216:dYOi92x4ZSWqCHaqGcDdaMYpGkcx2qsEfWzyWWX+dkDkzZxImfJRBGdSJTwo9b/U:fY0H1AWWX+GKZxlfjBGdaTwWpC
- TLSH T1C967CF89E2650884E976D2388A526907E3B17E6B0370C6CB367C7A6D0F777F50A3E741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc
- Size 30.8MB
- SHA256 83cc03f7f347543373591ab9a4b4d7f011005e9b81815bcac882c3ab00f240f6
- MD5 f4cf41a2213d93c0b83c5149c69e903e
- SHA1 8448dbbc3c224bfa08c32334e7284b24d4dea9fc
- SHA512 c10a9c43de024430034a0c21fbca64d42decc76338b05cfefcf28473a856f71e5c068e8228383fe4bffb426bf2ad4b0f0426a984092e57ae1365980413252c65
- SSDEEP 393216:dYOi92x4ZSWqCHaqGcDdaMYpGkcx2qsEfWzyWWX+dkDkzZxImfJRBGdSJTwo9b/U:fY0H1AWWX+GKZxlfjBGdaTwWpC
- TLSH T1C967CF89E2650884E976D2388A526907E3B17E6B0370C6CB367C7A6D0F777F50A3E741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects DarkSideRAT
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Suspicious use of SetThreadContext