2026-10-26_5a382e5ca7db575d7f4586f825bf569f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_5a382e5ca7db575d7f4586f825bf569f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 11.1MB
Sample261027-t7k8lavyex
SHA256 72d4587d0dcdae47b1a97ecc0e045743e8784d8d861514b62cad272b018a7f2e
MD5 5a382e5ca7db575d7f4586f825bf569f
SHA1 b7ebff79e4d5572d6451b578281783acdf73c078
SHA512 bbb797e0c8f0cee8b8316918e7017f43b948ae93841381193b7410b5b4f31b810504622c401a4ea905368340ee6f1b790f3d802b837d2e417e4c3a8217e48ddf
SSDEEP 196608:6mwRhY56LDaHcYmTN+c9P6kndqo7zNOWJQptshez1iHmGV1UjIa:6mwRhY56LDaHcTN+c9P6kndqodOWypt9
TLSH
T1D4C6AE42B29250E9D6268034CD929357E7717C190BB256FB3668B7ED2F376E13A3B700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_5a382e5ca7db575d7f4586f825bf569f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

File Explorer

2026-10-26_5a382e5ca7db575d7f4586f825bf569f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

.exe 11.1MB

2026-10-26_5a382e5ca7db575d7f4586f825bf569f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc

IMPHASH ccd80aeaac197a0e7deac848abfbcc0f
SHA256 72d4587d0dcdae47b1a97ecc0e045743e8784d8d861514b62cad272b018a7f2e
MD5 5a382e5ca7db575d7f4586f825bf569f
SHA1 b7ebff79e4d5572d6451b578281783acdf73c078
SHA512 bbb797e0c8f0cee8b8316918e7017f43b948ae93841381193b7410b5b4f31b810504622c401a4ea905368340ee6f1b790f3d802b837d2e417e4c3a8217e48ddf
SSDEEP 196608:6mwRhY56LDaHcYmTN+c9P6kndqo7zNOWJQptshez1iHmGV1UjIa:6mwRhY56LDaHcTN+c9P6kndqodOWypt9
TLSH
T1D4C6AE42B29250E9D6268034CD929357E7717C190BB256FB3668B7ED2F376E13A3B700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4665776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Alex\Desktop\Dock\bin\x64\Release\Dock.pdb

user32

GetWindow MonitorFromPoint PostMessageW AllowSetForegroundWindow GetKeyState DefWindowProcW GetWindowThreadProcessId ReleaseDC SetForegroundWindow SetRect GetMonitorInfoW SetRectEmpty SetFocus IntersectRect IsRectEmpty GetMessageTime UpdateLayeredWindowIndirect IsWindowVisible SetWindowPos SetWindowLongPtrW FindWindowExW UnionRect GetDC wsprintfW DestroyIcon PeekMessageW MsgWaitForMultipleObjectsEx GetIconInfo CharUpperW IsIconic GetClassNameW SwitchToThisWindow IsWindow CharLowerW GetWindowTextLengthW GetWindowLongW MessageBoxW GetGuiResources CreateWindowExW TrackMouseEvent GetForegroundWindow UnhookWindowsHookEx EnumDisplayMonitors DestroyWindow CallNextHookEx GetWindowLongPtrW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW SetTimer EnumWindows TranslateMessage FindWindowW LoadCursorW SetCapture SetWindowsHookExW SetCursor KillTimer PostQuitMessage ReleaseCapture UpdateLayeredWindow SystemParametersInfoA AppendMenuW UnregisterHotKey RegisterHotKey RegisterClipboardFormatW EmptyClipboard RemoveClipboardFormatListener SetClipboardData AddClipboardFormatListener IsClipboardFormatAvailable CallWindowProcW MoveWindow SetLayeredWindowAttributes GetClientRect UpdateWindow OpenClipboard CloseClipboard GetClipboardData ScreenToClient MessageBeep InflateRect GetDpiForWindow GetPropW EnumChildWindows FillRect EndDialog RemovePropW RedrawWindow DrawFocusRect GetDlgItemTextW GetSysColor DialogBoxIndirectParamW SetPropW MapDialogRect GetSystemMetricsForDpi DrawTextW CheckDlgButton GetSysColorBrush GetParent LoadImageW TrackPopupMenuEx GetSystemMetrics GetCapture MsgWaitForMultipleObjects PostThreadMessageW SendMessageW SetWindowTextW IsDialogMessageW GetDlgCtrlID SetDlgItemTextW SendDlgItemMessageW IsDlgButtonChecked GetDlgItem CreateDialogIndirectParamW InvalidateRect EnableWindow GetWindowTextW CheckMenuRadioItem CreatePopupMenu TrackPopupMenu SetMenuDefaultItem DestroyMenu GetCursorPos

gdi32

ExtTextOutW GdiFlush BitBlt RestoreDC CreateCompatibleBitmap CreateRectRgn ExtCreateRegion GetClipBox SaveDC GetGraphicsMode IntersectClipRect SelectClipRgn ExtSelectClipRgn SetGraphicsMode GetWorldTransform SetWorldTransform ModifyWorldTransform GetCharWidth32A GetFontData GetClipRgn SetTextAlign GetGlyphOutlineW GetOutlineTextMetricsA GetFontUnicodeRanges GetGlyphIndicesW SetMapMode GetTextMetricsA StretchDIBits CreateDCA GetGlyphOutlineA GetDIBits SetBkColor GetStockObject SetTextColor SetBkMode GetObjectW CreateSolidBrush CreateFontIndirectW RoundRect CreateFontW GetDeviceCaps SelectObject CreateDIBSection CreateCompatibleDC DeleteDC DeleteObject

shell32

SHCreateItemFromParsingName SHGetFileInfoW ord6 SHGetStockIconInfo SHOpenFolderAndSelectItems ord155 SHQueryRecycleBinW SHParseDisplayName ShellExecuteExW ord727 SHGetFolderPathW SHEmptyRecycleBinW ord176 DragQueryFileW ord88 DragFinish SHFileOperationW SHGetKnownFolderPath SHBindToParent ord62 ShellExecuteW ord190 CommandLineToArgvW SHQueryUserNotificationState

ole32

RevokeDragDrop CoCreateInstance RegisterDragDrop ReleaseStgMedium CoInitializeEx CoTaskMemFree OleUninitialize CoUninitialize OleInitialize

comctl32

ord413 ord410 ord412 ord381 InitCommonControlsEx

comdlg32

ChooseColorW GetOpenFileNameW ChooseFontW

advapi32

RegGetValueW OpenProcessToken CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW LookupPrivilegeValueA RegEnumValueW StartTraceW ProcessTrace CloseTrace CloseServiceHandle OpenSCManagerW EnumServicesStatusExW ControlTraceW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenTraceW EnableTraceEx2 RegCloseKey RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW AdjustTokenPrivileges RegLoadMUIStringW

msimg32

AlphaBlend

dwmapi

DwmGetColorizationColor DwmGetWindowAttribute DwmSetWindowAttribute

shlwapi

StrCmpLogicalW PathRemoveBackslashW PathFindExtensionW PathIsUNCW PathFindFileNameW PathIsRootW PathCombineW PathRemoveFileSpecW PathCanonicalizeW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

iphlpapi

FreeMibTable GetIfTable2 if_nametoindex

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CryptUnprotectData CryptProtectData CertEnumCertificatesInStore CertCloseStore CertOpenStore

ws2_32

select htons WSAStartup WSACleanup getsockopt send WSACloseEvent WSACreateEvent ntohl gethostname ioctlsocket sendto WSADuplicateSocketW WSASocketW recvfrom listen htonl freeaddrinfo getaddrinfo __WSAFDIsSet WSAIoctl WSASetLastError socket setsockopt recv WSAEnumNetworkEvents ntohs getsockname getpeername connect closesocket bind accept WSAGetLastError WSAWaitForMultipleEvents WSASetEvent WSAResetEvent WSAEventSelect

winmm

PlaySoundW

kernel32

GetModuleHandleExA VirtualQuery VirtualFree VirtualProtect VirtualAlloc GetCurrentProcessorNumber SwitchToThread TlsFree TlsSetValue SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException RtlUnwind FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer SetStdHandle AttachConsole TlsAlloc InitializeSRWLock TryAcquireSRWLockExclusive FormatMessageA WaitForSingleObjectEx SleepConditionVariableCS WakeConditionVariable WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle InitializeConditionVariable GetEnvironmentVariableA SetLastError InitializeCriticalSectionEx SleepEx VerifyVersionInfoW VerSetConditionMask GetProcessHeap HeapFree HeapReAlloc HeapAlloc CreateFileA GetLongPathNameA GetFileAttributesExA CreateFileMappingA GetFullPathNameA LoadLibraryA GetModuleHandleA GetWindowsDirectoryA WriteConsoleA GetModuleFileNameA LoadLibraryW QueueUserWorkItem TerminateThread SignalObjectAndWait IsProcessorFeaturePresent GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime ExitProcess TerminateProcess GetModuleHandleExW GetConsoleMode GetShortPathNameW OutputDebugStringA DuplicateHandle AddVectoredExceptionHandler RemoveVectoredExceptionHandler CreateProcessW AllocConsole ResetEvent ReadConsoleInputW PeekConsoleInputW ReadConsoleW WaitForMultipleObjectsEx CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork GetFileSize GetConsoleOutputCP CreateEventA FormatMessageW GetVersionExA InitOnceComplete InitOnceBeginInitialize TryEnterCriticalSection SetFilePointerEx ExitThread ResumeThread FreeLibraryAndExitThread RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetConsoleScreenBufferInfo WakeAllConditionVariable GetTempPathA GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetCurrentDirectoryW InitializeSListHead GetCommandLineW CreateMutexW GetTickCount64 GetLastError QueryPerformanceFrequency CloseHandle LocalFree GetCurrentProcessId QueryPerformanceCounter lstrcmpW GetProcAddress GetModuleHandleW lstrcpynW MultiByteToWideChar lstrcpynA WideCharToMultiByte ExpandEnvironmentStringsW GetFileAttributesW ReadFile SizeofResource GetFileSizeEx GetFullPathNameW GetPrivateProfileIntW EnumResourceNamesW CreateFileW GetPrivateProfileStringW LockResource LoadResource FindResourceW FreeLibrary LoadLibraryExW OpenProcess lstrcatW CreateThread QueryFullProcessImageNameW CreateDirectoryW WriteFile GetModuleFileNameW DeleteFileW MoveFileExW CopyFileW lstrcpyW GetCurrentProcess K32GetProcessMemoryInfo GetSystemTimeAsFileTime GetProcessHandleCount GetProcessTimes MulDiv GetVolumePathNameW GetCurrentThreadId GlobalSize GlobalAlloc GlobalFree CancelIoEx ReadDirectoryChangesW GlobalLock lstrcmpiW GlobalUnlock FindFirstFileW FindNextFileW FindClose lstrlenW GetLocaleInfoEx GetNumberFormatEx PeekConsoleInputA FindNLSStringEx GetLocalTime SystemTimeToFileTime GetSystemTime GetSystemTimes GetSystemInfo GlobalMemoryStatusEx WaitForSingleObject OpenFileMappingW UnmapViewOfFile Sleep CreateFileMappingW MapViewOfFile GetUserDefaultLocaleName GetTimeFormatEx GetDateFormatEx GetWindowsDirectoryW ReleaseSRWLockExclusive AcquireSRWLockExclusive CompareFileTime FindFirstFileExW EnterCriticalSection SetThreadPriority LeaveCriticalSection InitializeCriticalSection CreateEventW SetEvent GetCurrentThread DeleteCriticalSection GetLocaleInfoA EnumSystemLocalesA GetFileAttributesExW SetEndOfFile GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW SetFileAttributesW RemoveDirectoryW WriteConsoleW GetExitCodeProcess GetThreadLocale ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW GetThreadPriority TlsGetValue GetEnvironmentVariableW GetFileInformationByHandleEx SetConsoleMode DebugBreak GetSystemDirectoryW DeviceIoControl ReleaseMutex CreateMutexA GetNumberOfConsoleInputEvents FileTimeToSystemTime

secur32

InitSecurityInterfaceW

bcrypt

BCryptGenRandom

dwrite

DWriteCreateFactory

Name

.text

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

326KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

289KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

186KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=227, id=261, version=33145,

count=36, id=259, version=33145,

count=19, id=253, version=35721,

count=12, id=259, version=35721,

count=20, id=260, version=35721,

count=56, id=261, version=35721,

count=27, productName=Unmarked objects (old),

count=1, id=259, version=36260,

count=147, id=261, version=36260,

count=743, id=260, version=36260,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=57, id=260, version=33145,

count=1, id=262, version=33145,

count=39, id=257, version=33145,

count=588, id=1, productName=Unmarked objects,

count=43, id=264, version=36260,

count=1, id=256, version=36260,

count=1, id=255, version=36260,

count=1, id=151,

count=1, id=258, version=36260,