2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc
Size 30.8MB
Sample261027-cl1bysxx3m
SHA256 83cc03f7f347543373591ab9a4b4d7f011005e9b81815bcac882c3ab00f240f6
MD5 f4cf41a2213d93c0b83c5149c69e903e
SHA1 8448dbbc3c224bfa08c32334e7284b24d4dea9fc
SHA512 c10a9c43de024430034a0c21fbca64d42decc76338b05cfefcf28473a856f71e5c068e8228383fe4bffb426bf2ad4b0f0426a984092e57ae1365980413252c65
SSDEEP 393216:dYOi92x4ZSWqCHaqGcDdaMYpGkcx2qsEfWzyWWX+dkDkzZxImfJRBGdSJTwo9b/U:fY0H1AWWX+GKZxlfjBGdaTwWpC
TLSH
T1C967CF89E2650884E976D2388A526907E3B17E6B0370C6CB367C7A6D0F777F50A3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

.exe 30.8MB

2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

IMPHASH 2a642aea5286513a24bc4dd4cdf72e77
SHA256 83cc03f7f347543373591ab9a4b4d7f011005e9b81815bcac882c3ab00f240f6
MD5 f4cf41a2213d93c0b83c5149c69e903e
SHA1 8448dbbc3c224bfa08c32334e7284b24d4dea9fc
SHA512 c10a9c43de024430034a0c21fbca64d42decc76338b05cfefcf28473a856f71e5c068e8228383fe4bffb426bf2ad4b0f0426a984092e57ae1365980413252c65
SSDEEP 393216:dYOi92x4ZSWqCHaqGcDdaMYpGkcx2qsEfWzyWWX+dkDkzZxImfJRBGdSJTwo9b/U:fY0H1AWWX+GKZxlfjBGdaTwWpC
TLSH
T1C967CF89E2650884E976D2388A526907E3B17E6B0370C6CB367C7A6D0F777F50A3E741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32285696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSAResetEvent WSAIoctl WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSAEventSelect WSAWaitForMultipleEvents select WSASocketA sendto recvfrom listen bind accept inet_pton getnameinfo freeaddrinfo getaddrinfo WSASocketW socket shutdown setsockopt getpeername connect closesocket __WSAFDIsSet getservbyname getservbyport gethostbyaddr inet_ntoa inet_addr htons htonl WSACleanup WSAStartup gethostbyname ntohs getsockopt getsockname ioctlsocket WSAGetLastError WSASetLastError send recv gethostname

crypt32

CertEnumCertificatesInStore CertOpenSystemStoreA CertFreeCertificateContext CertOpenSystemStoreW CryptUnprotectData CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptProtectData CertCloseStore CertOpenStore CertFindCertificateInStore CertDuplicateCertificateContext CertGetCertificateContextProperty

iphlpapi

GetAdaptersInfo if_nametoindex

ntdll

RtlCaptureContext RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry VerSetConditionMask RtlCaptureStackBackTrace RtlVirtualUnwind RtlUnwind

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

HeapFree GetProcessHeap GetCurrentProcessId GetModuleHandleW GetProcAddress Sleep GetCurrentProcess ExitProcess GetTickCount GetModuleFileNameW TerminateProcess GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA LoadLibraryA GetLocaleInfoA GetCurrentThreadId MoveFileExW CloseHandle CreateThread GetCurrentThread OpenThread SuspendThread ResumeThread GetSystemTimeAsFileTime VirtualProtect CreateToolhelp32Snapshot Thread32First Thread32Next LocalFree GetLastError GetFileAttributesW GetFileAttributesExW GetTempPathW GetLocalTime GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW CreateFileW GetFileSize ReadFile CreateProcessW GetThreadContext SetThreadContext VirtualAllocEx VirtualProtectEx VirtualQueryEx ReadProcessMemory WriteProcessMemory CreateDirectoryW FlushFileBuffers SetFilePointer WriteFile AddVectoredExceptionHandler GetTickCount64 GetModuleFileNameA HeapAlloc SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemDirectoryA GetModuleHandleExW SetUnhandledExceptionFilter GetSystemInfo GetComputerNameA GetStdHandle GetFileType InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ReleaseSemaphore WaitForSingleObject GetExitCodeThread CreateSemaphoreA GetSystemTime SystemTimeToFileTime VirtualFree SwitchToFiber DeleteFiber CreateFiberEx GetACP ConvertFiberToThread ConvertThreadToFiberEx LoadLibraryW FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetSystemTimePreciseAsFileTime SwitchToThread WaitForSingleObjectEx SleepConditionVariableCS WakeConditionVariable WaitForMultipleObjects PeekNamedPipe VerifyVersionInfoW CompareFileTime GetEnvironmentVariableA GetFullPathNameW InitializeConditionVariable InitializeCriticalSectionEx SleepEx UnhandledExceptionFilter LoadLibraryExW GetDateFormatW GetEnvironmentVariableW GetFileInformationByHandleEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW GetStartupInfoW GetCommandLineA GetCommandLineW WriteConsoleW HeapSize GetTimeFormatW CompareStringW AreFileApisANSI WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete GetLocaleInfoEx GetCurrentDirectoryW FindFirstFileExW GetFileInformationByHandle LCMapStringW GetLocaleInfoW IsValidLocale SetFileInformationByHandle CreateFile2 RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree ExitThread FreeLibraryAndExitThread DeleteFileW SetConsoleCtrlHandler GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetFilePointerEx GetConsoleOutputCP IsProcessorFeaturePresent InitializeSListHead FormatMessageA GetModuleHandleExA IsDebuggerPresent GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx HeapReAlloc GetTimeZoneInformation SetStdHandle SetEndOfFile IsValidCodePage GetOEMCP SleepConditionVariableSRW

user32

SetForegroundWindow UpdateWindow GetSystemMetrics SetWindowPos ShowWindow DestroyWindow CreateWindowExW SetFocus GetProcessWindowStation RegisterClassExW UnregisterClassW DefWindowProcW GetWindowRect LoadCursorW ScreenToClient SetCursor SetCursorPos GetUserObjectInformationW IsWindowUnicode ReleaseCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetParent ClientToScreen GetCursorPos GetWindowTextW GetForegroundWindow MapVirtualKeyW ToUnicode GetKeyboardState GetAsyncKeyState IsWindowVisible PeekMessageW DispatchMessageW TranslateMessage GetWindowThreadProcessId GetClientRect IsWindow MessageBoxA MessageBoxW SetCapture

advapi32

CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptHashData CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey ReportEventW RegisterEventSourceW DeregisterEventSource RegQueryValueExA RegOpenKeyExA RegCloseKey CryptGenRandom CryptReleaseContext CryptAcquireContextW GetTokenInformation OpenProcessToken CryptGetHashParam

shell32

ShellExecuteA SHFileOperationW SHGetFolderPathW SHCreateDirectoryExW ShellExecuteExW ShellExecuteW SHGetKnownFolderPath

bcrypt

BCryptCreateHash BCryptHashData BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptFinishHash BCryptDestroyHash BCryptGenRandom

secur32

InitSecurityInterfaceW

ole32

CoTaskMemFree

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

Name

.text

Size

8.8MB

Virtual Size

8.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.6MB

Virtual Size

9.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

249KB

Virtual Size

289KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

421KB

Virtual Size

421KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.W6IFG

Size

371KB

Virtual Size

371KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.7lkU5

Size

438KB

Virtual Size

437KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.JFg

Size

10.8MB

Virtual Size

10.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

38KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_f4cf41a2213d93c0b83c5149c69e903e_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc

ws2_32

crypt32

iphlpapi

ntdll

d3d11

d3dcompiler_47

kernel32

user32

advapi32

shell32

bcrypt

secur32

ole32

imm32

generic